Mozilla Firefox, Firefox ESR und Thunderbird: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 11

• High 8.8
  CVE-2025-10533

  Integer overflow in the SVG component

  Integer overflow in the SVG component. This vulnerability was fixed in Firefox 143, Firefox ESR 115.28, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Sep 16, 2025
• High 8.8
  CVE-2025-10537

  Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143

  Memory safety bugs present in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary co…

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Sep 16, 2025
• High 8.1
  CVE-2025-10534

  Spoofing issue in the Site Permissions component

  Spoofing issue in the Site Permissions component. This vulnerability was fixed in Firefox 143 and Thunderbird 143.

  Mozilla Firefox Thunderbird firefox Browsers Wolfi
  Sep 16, 2025
• High 7.5
  CVE-2025-10535

  Information disclosure, mitigation bypass in the Privacy component in Firefox for Android

  Information disclosure, mitigation bypass in the Privacy component in Firefox for Android. This vulnerability was fixed in Firefox 143.

  Mozilla Firefox firefox Browsers Wolfi
  Sep 16, 2025
• High 7.3
  CVE-2025-10528

  Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component

  Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Sep 16, 2025
• High 7.1
  CVE-2025-10527

  Sandbox escape due to use-after-free in the Graphics: Canvas2D component

  Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Sep 16, 2025
• Medium 6.5
  CVE-2025-10529

  Same-origin policy bypass in the Layout component

  Same-origin policy bypass in the Layout component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Sep 16, 2025
• Medium 6.5
  CVE-2025-10530

  Spoofing issue in the WebAuthn component in Firefox for Android

  Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability was fixed in Firefox 143 and Thunderbird 143.

  Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi
  Sep 16, 2025
• Medium 6.5
  CVE-2025-10532

  Incorrect boundary conditions in the JavaScript: GC component

  Incorrect boundary conditions in the JavaScript: GC component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Sep 16, 2025
• Medium 6.2
  CVE-2025-10536

  Information disclosure in the Networking: Cache component

  Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Sep 16, 2025
• Medium 5.4
  CVE-2025-10531

  Mitigation bypass in the Web Compatibility: Tooling component

  Mitigation bypass in the Web Compatibility: Tooling component. This vulnerability was fixed in Firefox 143 and Thunderbird 143.

  Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi
  Sep 16, 2025

Revision history

1. 2026-06-15 #20

   Neue Updates von Oracle Linux aufgenommen

2. 2026-06-11 #19

   Neue Updates von Oracle Linux aufgenommen

3. 2026-06-10 #18

   Neue Updates von Oracle Linux aufgenommen

4. 2026-02-18 #17

   Neue Updates von Oracle Linux aufgenommen

5. 2026-02-02 #16

   Neue Updates von Ubuntu aufgenommen

6. 2025-12-15 #15

   Neue Updates von Oracle Linux aufgenommen

7. 2025-11-26 #14

   Neue Updates von SUSE aufgenommen

8. 2025-11-23 #13

   Neue Updates von openSUSE aufgenommen

9. 2025-10-09 #12

   Neue Updates von Rocky Enterprise Software Foundation aufgenommen

10. 2025-10-06 #11

    Neue Updates von Red Hat aufgenommen

11. 2025-10-05 #10

    Neue Updates von Red Hat aufgenommen

12. 2025-09-29 #9

    Neue Updates von Amazon aufgenommen

13. 2025-09-25 #8

    Neue Updates von Oracle Linux und Debian aufgenommen

14. 2025-09-24 #7

    Neue Updates von Red Hat aufgenommen

15. 2025-09-23 #6

    Neue Updates von SUSE und Oracle Linux aufgenommen

16. 2025-09-22 #5

    Neue Updates von SUSE aufgenommen

17. 2025-09-21 #4

    Neue Updates von openSUSE und Red Hat aufgenommen

18. 2025-09-18 #3

    Neue Updates von Oracle Linux, Debian und Red Hat aufgenommen

19. 2025-09-17 #2

    Neue Updates von European Union Vulnerability Database, openSUSE und Red Hat aufgenommen

20. 2025-09-16 #1

    Initiale Fassung

References

• Mozilla Foundation Security Advisory vom 2025-09-16
  https://www.mozilla.org/en-US/security/advisories/mfsa2025-73/
• Mozilla Foundation Security Advisory vom 2025-09-16
  https://www.mozilla.org/en-US/security/advisories/mfsa2025-74/
• Mozilla Foundation Security Advisory vom 2025-09-16
  https://www.mozilla.org/en-US/security/advisories/mfsa2025-75/
• Mozilla Foundation Security Advisory vom 2025-09-16
  https://www.mozilla.org/en-US/security/advisories/mfsa2025-77/
• Mozilla Foundation Security Advisory vom 2025-09-16
  https://www.mozilla.org/en-US/security/advisories/mfsa2025-78/
• openSUSE Security Update OPENSUSE-SU-2025:15555-1 vom 2025-09-17
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LMLPHFM3UPQPCJUYGGQ5GBPIA6IJMG2N/
• Red Hat Security Advisory RHSA-2025:16108 vom 2025-09-17
  https://access.redhat.com/errata/RHSA-2025:16108
• Red Hat Security Advisory RHSA-2025:16109 vom 2025-09-17
  https://access.redhat.com/errata/RHSA-2025:16109
• Red Hat Security Advisory RHSA-2025:16156 vom 2025-09-18
  https://access.redhat.com/errata/RHSA-2025:16156
• Oracle Linux Security Advisory ELSA-2025-16108 vom 2025-09-18
  https://linux.oracle.com/errata/ELSA-2025-16108.html
• Oracle Linux Security Advisory ELSA-2025-16157 vom 2025-09-19
  https://linux.oracle.com/errata/ELSA-2025-16157.html
• Oracle Linux Security Advisory ELSA-2025-16109 vom 2025-09-19
  https://linux.oracle.com/errata/ELSA-2025-16109.html
• Debian Security Advisory DSA-6003 vom 2025-09-18
  https://lists.debian.org/debian-security-announce/2025/msg00167.html
• Red Hat Security Advisory RHSA-2025:16157 vom 2025-09-18
  https://access.redhat.com/errata/RHSA-2025:16157
• Oracle Linux Security Advisory ELSA-2025-16156 vom 2025-09-18
  https://linux.oracle.com/errata/ELSA-2025-16156.html
• Debian Security Advisory DLA-4305 vom 2025-09-19
  https://lists.debian.org/debian-lts-announce/2025/09/msg00020.html
• openSUSE Security Update OPENSUSE-SU-2025:15565-1 vom 2025-09-20
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IVWMXIX76CVERVDJ7CKE5YHDFVRV5G55/
• Red Hat Security Advisory RHSA-2025:16260 vom 2025-09-22
  https://access.redhat.com/errata/RHSA-2025:16260
• SUSE Security Update SUSE-SU-2025:03291-1 vom 2025-09-22
  https://lists.suse.com/pipermail/sle-security-updates/2025-September/022604.html
• SUSE Security Update SUSE-SU-2025:03309-1 vom 2025-09-23
  https://lists.suse.com/pipermail/sle-security-updates/2025-September/022611.html
• Oracle Linux Security Advisory ELSA-2025-16260 vom 2025-09-23
  https://linux.oracle.com/errata/ELSA-2025-16260.html
• Red Hat Security Advisory RHSA-2025:16589 vom 2025-09-24
  https://access.redhat.com/errata/RHSA-2025:16589
• Oracle Linux Security Advisory ELSA-2025-16589 vom 2025-09-25
  https://linux.oracle.com/errata/ELSA-2025-16589.html
• Debian Security Advisory DSA-6011 vom 2025-09-25
  https://lists.debian.org/debian-security-announce/2025/msg00176.html
• Debian Security Advisory DLA-4311 vom 2025-09-26
  https://lists.debian.org/debian-lts-announce/2025/09/msg00026.html
• Amazon Linux Security Advisory ALAS2-2025-3008 vom 2025-09-29
  https://alas.aws.amazon.com/AL2/ALAS2-2025-3008.html
• Amazon Linux Security Advisory ALAS2FIREFOX-2025-043 vom 2025-09-30
  https://alas.aws.amazon.com/AL2/ALAS2FIREFOX-2025-043.html
• Red Hat Security Advisory RHSA-2025:17341 vom 2025-10-06
  https://access.redhat.com/errata/RHSA-2025:17341
• Red Hat Security Advisory RHSA-2025:17346 vom 2025-10-06
  https://access.redhat.com/errata/RHSA-2025:17346
• Red Hat Security Advisory RHSA-2025:17342 vom 2025-10-06
  https://access.redhat.com/errata/RHSA-2025:17342
• Red Hat Security Advisory RHSA-2025:17343 vom 2025-10-06
  https://access.redhat.com/errata/RHSA-2025:17343
• Red Hat Security Advisory RHSA-2025:17340 vom 2025-10-06
  https://access.redhat.com/errata/RHSA-2025:17340
• Red Hat Security Advisory RHSA-2025:17345 vom 2025-10-06
  https://access.redhat.com/errata/RHSA-2025:17345
• Red Hat Security Advisory RHSA-2025:17344 vom 2025-10-06
  https://access.redhat.com/errata/RHSA-2025:17344
• Red Hat Security Advisory RHSA-2025:17373 vom 2025-10-06
  https://access.redhat.com/errata/RHSA-2025:17373
• Red Hat Security Advisory RHSA-2025:17371 vom 2025-10-06
  https://access.redhat.com/errata/RHSA-2025:17371
• Red Hat Security Advisory RHSA-2025:17372 vom 2025-10-06
  https://access.redhat.com/errata/RHSA-2025:17372
• Red Hat Security Advisory RHSA-2025:17368 vom 2025-10-06
  https://access.redhat.com/errata/RHSA-2025:17368
• Red Hat Security Advisory RHSA-2025:17367 vom 2025-10-06
  https://access.redhat.com/errata/RHSA-2025:17367
• Red Hat Security Advisory RHSA-2025:17378 vom 2025-10-06
  https://access.redhat.com/errata/RHSA-2025:17378
• Red Hat Security Advisory RHSA-2025:17374 vom 2025-10-06
  https://access.redhat.com/errata/RHSA-2025:17374
• Red Hat Security Advisory RHSA-2025:17453 vom 2025-10-07
  https://access.redhat.com/errata/RHSA-2025:17453
• Rocky Linux Security Advisory RLSA-2025:16108 vom 2025-10-10
  https://errata.build.resf.org/RLSA-2025:16108
• Rocky Linux Security Advisory RLSA-2025:16156 vom 2025-10-10
  https://errata.build.resf.org/RLSA-2025:16156
• openSUSE Security Update OPENSUSE-SU-2025-20065-1 vom 2025-11-21
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SFEJE33NBZORUUFJM7PNNYUPIRCOD25K/
• SUSE Security Update SUSE-SU-2025:21021-1 vom 2025-11-26
  https://lists.suse.com/pipermail/sle-security-updates/2025-November/023380.html
• Oracle Linux Security Advisory ELSA-2025-17453 vom 2025-12-16
  https://linux.oracle.com/errata/ELSA-2025-17453.html
• Ubuntu Security Notice USN-7991-1 vom 2026-02-03
  https://ubuntu.com/security/notices/USN-7991-1
• Oracle Linux Security Advisory ELSA-2026-2231 vom 2026-02-19
  https://linux.oracle.com/errata/ELSA-2026-2231.html
• Oracle Linux Security Advisory ELSA-2026-3984 vom 2026-06-11
  https://linux.oracle.com/errata/ELSA-2026-3984.html
• Oracle Linux Security Advisory ELSA-2026-8427 vom 2026-06-11
  https://linux.oracle.com/errata/ELSA-2026-8427.html
• Oracle Linux Security Advisory ELSA-2026-13977 vom 2026-06-11
  https://linux.oracle.com/errata/ELSA-2026-13977.html
• Oracle Linux Security Advisory ELSA-2026-22708 vom 2026-06-15
  https://linux.oracle.com/errata/ELSA-2026-22708.html
• Oracle Linux Security Advisory ELSA-2026-19704 vom 2026-06-16
  https://linux.oracle.com/errata/ELSA-2026-19704.html