Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 15

• Critical 9.8
  CVE-2024-11704

  A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path. Under speci…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi
  Nov 26, 2024
• Critical 9.8
  CVE-2025-1009

  Use-after-free in XSLT

  An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 4, 2025
• Critical 9.8
  CVE-2025-1010

  Use-after-free in Custom Highlight

  An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 4, 2025
• Critical 9.8
  CVE-2025-1011

  A bug in WebAssembly code generation could result in a crash

  A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code execution. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 4, 2025
• Critical 9.8
  CVE-2025-1012

  Use-after-free during concurrent delazification

  A race during concurrent delazification could have led to a use-after-free. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 4, 2025
• Critical 9.8
  CVE-2025-1016

  Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20, and Thunderbird 128.7

  Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could ha…

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 4, 2025
• Critical 9.8
  CVE-2025-1017

  Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7

  Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.…

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 4, 2025
• Critical 9.8
  CVE-2025-1020

  Memory safety bugs fixed in Firefox 135 and Thunderbird 135

  Memory safety bugs present in Firefox 134 and Thunderbird 134. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefo…

  Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi
  Feb 4, 2025
• High 8.8
  CVE-2025-1014

  Certificate length was not properly checked

  Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 4, 2025
• High 7.5
  CVE-2024-49040

  Microsoft Exchange Server Spoofing Vulnerability

  Microsoft Exchange Server Spoofing Vulnerability

  Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 14 Microsoft Exchange Server 2019 Cumulative Update 13
  Nov 12, 2024
• High 7.3
  CVE-2025-1018

  Fullscreen notification is not displayed when fullscreen is re-requested

  The fullscreen notification is prematurely hidden when fullscreen is re-requested quickly by the user. This could have been leveraged to perform a potential spoofing attack. This vulnerability was fixed in Firefox 135 and Thunderbird 135.

  Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi
  Feb 4, 2025
• Medium 6.5
  CVE-2025-0510

  Address of e-mail sender can be spoofed by malicious email

  Thunderbird displayed an incorrect sender address if the From field of an email used the invalid group name syntax that is described in CVE-2024-49040. This vulnerability was fixed in Thunderbird 128.7 and Thunderbird 135.

  Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  Feb 4, 2025
• Medium 6.5
  CVE-2025-1013

  Potential opening of private browsing tabs in normal browsing windows

  A race condition could have led to private browsing tabs being opened in normal browsing windows. This could have resulted in a potential privacy leak. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Feb 4, 2025
• Medium 5.4
  CVE-2025-1015 Public exploit

  Unsanitized address book fields

  The Thunderbird Address Book URI fields contained unsanitized links. This could be used by an attacker to create and export an address book containing a malicious payload in a field. For example, in the “Other” field of the Instant Messaging section. If anoth…

  Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  Feb 4, 2025
• Medium 4.3
  CVE-2025-1019

  Fullscreen notification not properly displayed

  The z-order of the browser windows could be manipulated to hide the fullscreen notification. This could potentially be leveraged to perform a spoofing attack. This vulnerability was fixed in Firefox 135 and Thunderbird 135.

  Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi
  Feb 4, 2025

Revision history

1. 2026-02-02 #16

   Neue Updates von Ubuntu aufgenommen

2. 2025-09-17 #15

   Neue Updates von Gentoo aufgenommen

3. 2025-06-02 #14

   Neue Updates von XEROX aufgenommen

4. 2025-05-11 #13

   Neue Updates von Gentoo aufgenommen

5. 2025-04-29 #12

   Neue Updates aufgenommen

6. 2025-03-09 #11

   Neue Updates von Amazon aufgenommen

7. 2025-03-02 #10

   Neue Updates von Amazon aufgenommen

8. 2025-02-25 #9

   Neue Updates von Amazon aufgenommen

9. 2025-02-13 #8

   Neue Updates von Rocky Enterprise Software Foundation aufgenommen

10. 2025-02-12 #7

    Neue Updates von Oracle Linux aufgenommen

11. 2025-02-11 #6

    Neue Updates von Red Hat aufgenommen

12. 2025-02-10 #5

    Neue Updates von Ubuntu, Oracle Linux und SUSE aufgenommen

13. 2025-02-09 #4

    Neue Updates von Debian und Red Hat aufgenommen

14. 2025-02-06 #3

    Neue Updates von openSUSE und SUSE aufgenommen

15. 2025-02-05 #2

    Neue Updates von Oracle Linux und Debian aufgenommen

16. 2025-02-04 #1

    Initiale Fassung

References

• Mozilla Foundation Security Advisory vom 2025-02-04
  https://www.mozilla.org/en-US/security/advisories/mfsa2025-07/
• Mozilla Foundation Security Advisory vom 2025-02-04
  https://www.mozilla.org/en-US/security/advisories/mfsa2025-08/
• Mozilla Foundation Security Advisory vom 2025-02-04
  https://www.mozilla.org/en-US/security/advisories/mfsa2025-09/
• Mozilla Foundation Security Advisory vom 2025-02-04
  https://www.mozilla.org/en-US/security/advisories/mfsa2025-10/
• Mozilla Foundation Security Advisory vom 2025-02-04
  https://www.mozilla.org/en-US/security/advisories/mfsa2025-11/
• Red Hat Security Advisory RHSA-2025:1066 vom 2025-02-05
  https://access.redhat.com/errata/RHSA-2025:1066
• Oracle Linux Security Advisory ELSA-2025-1066 vom 2025-02-06
  https://linux.oracle.com/errata/ELSA-2025-1066.html
• Debian Security Advisory DSA-5858 vom 2025-02-05
  https://lists.debian.org/debian-security-announce/2025/msg00020.html
• Red Hat Security Advisory RHSA-2025:1135 vom 2025-02-06
  https://access.redhat.com/errata/RHSA-2025:1135
• Red Hat Security Advisory RHSA-2025:1136 vom 2025-02-06
  https://access.redhat.com/errata/RHSA-2025:1136
• Red Hat Security Advisory RHSA-2025:1137 vom 2025-02-06
  https://access.redhat.com/errata/RHSA-2025:1137
• Red Hat Security Advisory RHSA-2025:1138 vom 2025-02-06
  https://access.redhat.com/errata/RHSA-2025:1138
• Red Hat Security Advisory RHSA-2025:1132 vom 2025-02-06
  https://access.redhat.com/errata/RHSA-2025:1132
• Red Hat Security Advisory RHSA-2025:1133 vom 2025-02-06
  https://access.redhat.com/errata/RHSA-2025:1133
• Red Hat Security Advisory RHSA-2025:1139 vom 2025-02-06
  https://access.redhat.com/errata/RHSA-2025:1139
• Red Hat Security Advisory RHSA-2025:1140 vom 2025-02-06
  https://access.redhat.com/errata/RHSA-2025:1140
• openSUSE Security Update OPENSUSE-SU-2025:14731-1 vom 2025-02-06
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/MP4SZWYCKRN2DG7QYUK64Y4TXD7ABUH5/
• SUSE Security Update SUSE-SU-2025:0374-1 vom 2025-02-06
  https://lists.suse.com/pipermail/sle-security-updates/2025-February/020274.html
• openSUSE Security Update OPENSUSE-SU-2025:14730-1 vom 2025-02-06
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/YKL4Q4JIJAFIP47G3Y7MQZ2RNDDMCC33/
• Debian Security Advisory DSA-5860 vom 2025-02-07
  https://lists.debian.org/debian-security-announce/2025/msg00022.html
• Red Hat Security Advisory RHSA-2025:1184 vom 2025-02-10
  https://access.redhat.com/errata/RHSA-2025:1184
• Debian Security Advisory DLA-4045 vom 2025-02-07
  https://lists.debian.org/debian-lts-announce/2025/02/msg00006.html
• Debian Security Advisory DLA-4044 vom 2025-02-07
  https://lists.debian.org/debian-lts-announce/2025/02/msg00005.html
• SUSE Security Update SUSE-SU-2025:0391-1 vom 2025-02-10
  https://lists.suse.com/pipermail/sle-security-updates/2025-February/020295.html
• Ubuntu Security Notice USN-7263-1 vom 2025-02-11
  https://ubuntu.com/security/notices/USN-7263-1
• Oracle Linux Security Advisory ELSA-2025-1184 vom 2025-02-10
  http://linux.oracle.com/errata/ELSA-2025-1184.html
• SUSE Security Update SUSE-SU-2025:0405-1 vom 2025-02-10
  https://lists.suse.com/pipermail/sle-security-updates/2025-February/020302.html
• Oracle Linux Security Advisory ELSA-2025-1184 vom 2025-02-10
  https://oss.oracle.com/pipermail/el-errata/2025-February/017147.html
• Oracle Linux Security Advisory ELSA-2025-1184 vom 2025-02-10
  https://linux.oracle.com/errata/ELSA-2025-1184.html
• Red Hat Security Advisory RHSA-2025:1283 vom 2025-02-11
  https://access.redhat.com/errata/RHSA-2025:1283
• Red Hat Security Advisory RHSA-2025:1292 vom 2025-02-11
  https://access.redhat.com/errata/RHSA-2025:1292
• Red Hat Security Advisory RHSA-2025:1317 vom 2025-02-11
  https://access.redhat.com/errata/RHSA-2025:1317
• Red Hat Security Advisory RHSA-2025:1318 vom 2025-02-11
  https://access.redhat.com/errata/RHSA-2025:1318
• Red Hat Security Advisory RHSA-2025:1319 vom 2025-02-11
  https://access.redhat.com/errata/RHSA-2025:1319
• Red Hat Security Advisory RHSA-2025:1341 vom 2025-02-12
  https://access.redhat.com/errata/RHSA-2025:1341
• Red Hat Security Advisory RHSA-2025:1340 vom 2025-02-12
  https://access.redhat.com/errata/RHSA-2025:1340
• Red Hat Security Advisory RHSA-2025:1339 vom 2025-02-12
  https://access.redhat.com/errata/RHSA-2025:1339
• Red Hat Security Advisory RHSA-2025:1348 vom 2025-02-12
  https://access.redhat.com/errata/RHSA-2025:1348
• Oracle Linux Security Advisory ELSA-2025-1283 vom 2025-02-12
  https://linux.oracle.com/errata/ELSA-2025-1283.html
• Oracle Linux Security Advisory ELSA-2025-1292 vom 2025-02-12
  https://linux.oracle.com/errata/ELSA-2025-1292.html
• Oracle Linux Security Advisory ELSA-2025-1132 vom 2025-02-12
  https://linux.oracle.com/errata/ELSA-2025-1132.html
• Rocky Linux Security Advisory RLSA-2025:1283 vom 2025-02-13
  https://errata.build.resf.org/RLSA-2025:1283
• Amazon Linux Security Advisory ALAS-2025-2765 vom 2025-02-25
  https://alas.aws.amazon.com/AL2/ALAS-2025-2765.html
• Amazon Linux Security Advisory ALASFIREFOX-2025-034 vom 2025-02-25
  https://alas.aws.amazon.com/AL2/ALASFIREFOX-2025-034.html
• Amazon Linux Security Advisory ALASFIREFOX-2025-035 vom 2025-03-01
  https://alas.aws.amazon.com/AL2/ALASFIREFOX-2025-035.html
• Amazon Linux Security Advisory ALAS-2025-2789 vom 2025-03-07
  https://alas.aws.amazon.com/AL2/ALAS-2025-2789.html
• IGEL Product Security Information
  https://kb.igel.com/security-safety/current/isn-2025-09-firefox-esr-vulnerabilities
• Gentoo Linux Security Advisory GLSA-202505-03 vom 2025-05-12
  https://security.gentoo.org/glsa/202505-03
• XEROX Security Advisory XRX25-012 vom 2025-06-02
  https://security.business.xerox.com/wp-content/uploads/2025/06/Xerox-Security-Bulletin-XRX25-012-for-Xerox-FreeFlow-Print-Server-v9.pdf
• Gentoo Linux Security Advisory GLSA-202509-02 vom 2025-09-18
  https://security.gentoo.org/glsa/202509-02
• Ubuntu Security Notice USN-7991-1 vom 2026-02-03
  https://ubuntu.com/security/notices/USN-7991-1