Skip to content
OpenAdvisories
High WID-SEC-2025-1623 21 CVEs

Mozilla Firefox , Firefox ESR und Thunderbird: Mehrere Schwachstellen

Published Jul 22, 2025 · Updated Jun 11, 2026 · Revision 20 · de-DE

Vendor: amazon Vendor: Debian Vendor: Fedora Vendor: IGEL Vendor: Mozilla Vendor: Oracle Vendor: Red Hat Vendor: RESF Vendor: SUSE Vendor: Ubuntu Vendor: Xerox Product: Enterprise Linux Product: Firefox Product: Firefox ESR Product: FreeFlow Print Server Product: Linux Product: Linux Product: Linux Product: Linux Product: Linux Product: Linux 2 Product: openSUSE Product: OS Product: Rocky Linux Product: Thunderbird Platform: macOS Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Mozilla Firefox, Mozilla Firefox ESR und Mozilla Thunderbird ausnutzen, um beliebigen Programmcode auszuführen, einen Denial-of-Service-Zustand zu verursachen, vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen und andere, nicht näher definierte Angriffe durchzuführen.

Product

Firefox ist ein Open Source Web Browser.
ESR ist die Variante mit verlängertem Support.
Thunderbird ist ein Open Source E-Mail Client.

Vulnerabilities 21

  • Critical 9.8
    CVE-2025-54143

    Sandboxed iframes could allow local downloads despite sandbox restrictions

    Sandboxed iframes on webpages could potentially allow downloads to the device, bypassing the expected sandbox restrictions declared on the parent page. This vulnerability was fixed in Firefox for iOS 141.

    Mozilla Firefox for iOS firefox iOS Browsers Wolfi
  • Critical 9.8
    CVE-2025-8028

    Large branch table could lead to truncated instruction

    On arm64, a WASM `br_table` instruction with a lot of entries could lead to the label being too far from the instruction causing truncation and incorrect computation of the branch address. This vulnerability was fixed in Firefox 141, Firefox ESR 115.26, Firef…

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  • Critical 9.8
    CVE-2025-8031

    Incorrect URL stripping in CSP reports

    The `username:password` part was not correctly stripped from URLs in CSP reports potentially leaking HTTP Basic Authentication credentials. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13…

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  • Critical 9.8
    CVE-2025-8038

    CSP frame-src was not correctly enforced for paths

    Thunderbird ignored paths when checking the validity of navigations in a frame. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.

    Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi
  • Critical 9.8
    CVE-2025-8042

    Sandboxed iframe could start downloads

    Firefox for Android allowed a sandboxed iframe without the `allow-downloads` attribute to start downloads. This vulnerability was fixed in Firefox 141.

    Mozilla Firefox firefox Browsers Wolfi
  • Critical 9.8
    CVE-2025-8043

    Incorrect URL truncation

    Focus incorrectly truncated URLs towards the beginning instead of around the origin. This vulnerability was fixed in Firefox 141.

    Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu
  • Critical 9.8
    CVE-2025-8044

    Memory safety bugs fixed in Firefox 141 and Thunderbird 141

    Memory safety bugs present in Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefo…

    Mozilla Firefox Thunderbird mozjs38 Browsers Ubuntu
  • Critical 9.1
    CVE-2025-54145

    Scanning a malicious URL utilizing Firefox's open-text scheme with the QR code scanner could load arbitrary websites

    The QR scanner could allow arbitrary websites to be opened if a user was tricked into scanning a malicious link that leveraged Firefox's open-text URL scheme. This vulnerability was fixed in Firefox for iOS 141.

    Mozilla Firefox for iOS firefox iOS Browsers Wolfi
  • Critical 9.1
    CVE-2025-8037

    Nameless cookies shadow secure cookies

    Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie included the `Secure` attribute. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbi…

    Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi
  • High 8.8
    CVE-2025-8034

    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141

    Memory safety bugs present in Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough ef…

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  • High 8.8
    CVE-2025-8035

    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141

    Memory safety bugs present in Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these c…

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  • High 8.8
    CVE-2025-8040

    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141

    Memory safety bugs present in Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary co…

    Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi
  • High 8.1
    CVE-2025-8029

    javascript: URLs executed on object and embed tags

    Thunderbird executed `javascript:` URLs when used in `object` and `embed` tags. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  • High 8.1
    CVE-2025-8030

    Potential user-assisted code execution in “Copy as cURL” command

    Insufficient escaping in the “Copy as cURL” feature could potentially be used to trick a user into executing unexpected code. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderb…

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  • High 8.1
    CVE-2025-8032

    XSLT documents could bypass CSP

    XSLT document loading did not correctly propagate the source document which bypassed its CSP. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  • High 8.1
    CVE-2025-8036

    DNS rebinding circumvents CORS

    Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.

    Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi
  • High 8.1
    CVE-2025-8039

    Search terms persisted in URL bar

    In some cases search terms persisted in the URL bar even after navigating away from the search page. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.

    Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi
  • Medium 6.5
    CVE-2025-8027

    JavaScript engine only wrote partial return value to stack

    On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack. Baseline-JIT, however, read the entire 64 bits. This vulnerability was fixed in Firefox 141, Firefox ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1, Thunder…

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  • Medium 6.5
    CVE-2025-8033

    Incorrect JavaScript state machine for generators

    The JavaScript engine did not handle closed generators correctly and it was possible to resume them leading to a nullptr deref. This vulnerability was fixed in Firefox 141, Firefox ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbir…

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  • Medium 5.4
    CVE-2025-54144

    Internal Firefox open-text URL scheme allowed loading of arbitrary URLs

    The URL scheme used by Firefox to facilitate searching of text queries could incorrectly allow attackers to open arbitrary website URLs or internal pages if a user was tricked into clicking a link. This vulnerability was fixed in Firefox for iOS 141.

    Mozilla Firefox for iOS firefox iOS Browsers Wolfi
  • Medium 5.3
    CVE-2025-8041

    Incorrect URL truncation in Firefox for Android

    In the address bar, Firefox for Android truncated the display of URLs from the end instead of prioritizing the origin. This vulnerability was fixed in Firefox 141.

    Mozilla Firefox firefox Browsers Wolfi

Revision history

  1. #20

    Neue Updates von Oracle Linux aufgenommen

  2. #19

    Neue Updates von Oracle Linux aufgenommen

  3. #18

    Neue Updates von Oracle Linux aufgenommen

  4. #17

    Neue Updates von Ubuntu aufgenommen

  5. #16

    Neue Updates von SUSE aufgenommen

  6. #15

    Neue Updates von openSUSE aufgenommen

  7. #14

    Neue Updates von XEROX aufgenommen

  8. #13

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

  9. #12

    Referenz(en) aufgenommen: EUVD-2025-25232, EUVD-2025-25229, EUVD-2025-25230, EUVD-2025-25233

  10. #11

    Neue Updates von Oracle Linux aufgenommen

  11. #10

    Neue Updates von Red Hat aufgenommen

  12. #9

    Neue Updates von Oracle Linux aufgenommen

  13. #8

    Neue Updates von Amazon aufgenommen

  14. #7

    Neue Updates von Oracle Linux aufgenommen

  15. #6

    Neue Updates von Red Hat aufgenommen

  16. #5

    Neue Updates von Red Hat aufgenommen

  17. #4

    Neue Updates von Debian, openSUSE, Red Hat und SUSE aufgenommen

  18. #3

    Neue Updates von Oracle Linux und Red Hat aufgenommen

  19. #2

    Neue Updates von Debian aufgenommen

  20. #1

    Initiale Fassung

References