Mozilla Firefox und Firefox ESR: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 16

• Critical 9.8
  CVE-2025-13021

  Incorrect boundary conditions in the Graphics: WebGPU component

  Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145.

  Mozilla Firefox Thunderbird firefox Browsers Wolfi
  Nov 11, 2025
• Critical 9.8
  CVE-2025-13022

  Incorrect boundary conditions in the Graphics: WebGPU component

  Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145.

  Mozilla Firefox Thunderbird firefox Browsers Wolfi
  Nov 11, 2025
• Critical 9.8
  CVE-2025-13023

  Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component

  Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145.

  Mozilla Firefox Thunderbird firefox Browsers Wolfi
  Nov 11, 2025
• Critical 9.8
  CVE-2025-13024

  JIT miscompilation in the JavaScript Engine: JIT component

  JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 145 and Thunderbird 145.

  Mozilla Firefox Thunderbird mozjs38 Browsers Ubuntu Wolfi
  Nov 11, 2025
• Critical 9.8
  CVE-2025-13026

  Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component

  Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145.

  Mozilla Firefox Thunderbird firefox Browsers Wolfi
  Nov 11, 2025
• High 8.8
  CVE-2025-13014

  Use-after-free in the Audio/Video component

  Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Firefox ESR 115.30, Thunderbird 145, and Thunderbird 140.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Nov 11, 2025
• High 8.8
  CVE-2025-13020

  Use-after-free in the WebRTC: Audio/Video component

  Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Nov 11, 2025
• High 8.1
  CVE-2025-13017

  Same-origin policy bypass in the DOM: Notifications component

  Same-origin policy bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Nov 11, 2025
• High 8.1
  CVE-2025-13018

  Mitigation bypass in the DOM: Security component

  Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Nov 11, 2025
• High 8.1
  CVE-2025-13019

  Same-origin policy bypass in the DOM: Workers component

  Same-origin policy bypass in the DOM: Workers component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Nov 11, 2025
• High 8.1
  CVE-2025-13027

  Memory safety bugs fixed in Firefox 145 and Thunderbird 145

  Memory safety bugs present in Firefox 144 and Thunderbird 144. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefo…

  Mozilla Firefox Thunderbird mozjs38 Browsers Ubuntu Wolfi
  Nov 11, 2025
• High 7.5
  CVE-2025-13012

  Race condition in the Graphics component

  Race condition in the Graphics component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Firefox ESR 115.30, Thunderbird 145, and Thunderbird 140.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Nov 11, 2025
• High 7.5
  CVE-2025-13016

  Incorrect boundary conditions in the JavaScript: WebAssembly component

  Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Nov 11, 2025
• High 7.5
  CVE-2025-13025

  Incorrect boundary conditions in the Graphics: WebGPU component

  Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145.

  Mozilla Firefox Thunderbird firefox Browsers Wolfi
  Nov 11, 2025
• Medium 6.1
  CVE-2025-13013

  Mitigation bypass in the DOM: Core & HTML component

  Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Firefox ESR 115.30, Thunderbird 145, and Thunderbird 140.5.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Nov 11, 2025
• Low 3.4
  CVE-2025-13015

  Spoofing issue in Firefox

  Spoofing issue in Firefox. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, and Firefox ESR 115.30.

  Mozilla Firefox thunderbird mozjs38 Browsers Debian Ubuntu Wolfi
  Nov 11, 2025

Revision history

1. 2026-06-30 #25

   Neue Updates von Oracle Linux aufgenommen

2. 2026-06-15 #24

   Neue Updates von Oracle Linux aufgenommen

3. 2026-06-11 #23

   Neue Updates von Oracle Linux aufgenommen

4. 2026-06-10 #22

   Neue Updates von Oracle Linux aufgenommen

5. 2026-02-18 #21

   Neue Updates von Oracle Linux aufgenommen

6. 2026-02-02 #20

   Neue Updates von Ubuntu aufgenommen

7. 2026-01-05 #19

   Neue Updates von Amazon aufgenommen

8. 2026-01-04 #18

   Neue Updates von openSUSE aufgenommen

9. 2025-12-16 #17

   Neue Updates von Oracle Linux aufgenommen

10. 2025-12-08 #16

    Neue Updates von Red Hat und Amazon aufgenommen

11. 2025-12-07 #15

    Neue Updates von Red Hat aufgenommen

12. 2025-12-03 #14

    Neue Updates von Oracle Linux aufgenommen

13. 2025-12-01 #13

    Neue Updates von Red Hat und Oracle Linux aufgenommen

14. 2025-11-30 #12

    Neue Updates von Red Hat aufgenommen

15. 2025-11-26 #11

    Neue Updates von SUSE und Oracle Linux aufgenommen

16. 2025-11-25 #10

    Neue Updates von Oracle Linux aufgenommen

17. 2025-11-24 #9

    Neue Updates von SUSE aufgenommen

18. 2025-11-23 #8

    Neue Updates von openSUSE und Rocky Enterprise Software Foundation aufgenommen

19. 2025-11-20 #7

    Neue Updates von Red Hat aufgenommen

20. 2025-11-19 #6

    Neue Updates von Red Hat aufgenommen

21. 2025-11-18 #5

    Neue Updates von openSUSE aufgenommen

22. 2025-11-16 #4

    Neue Updates von Debian, Mozilla und openSUSE aufgenommen

23. 2025-11-13 #3

    Neue Updates von Red Hat aufgenommen

24. 2025-11-12 #2

    Neue Updates von Red Hat und Debian aufgenommen

25. 2025-11-11 #1

    Initiale Fassung

References

• Mozilla Foundation Security Advisory MFSA 2025-87 vom 2025-11-11
  https://www.mozilla.org/en-US/security/advisories/mfsa2025-87/
• Mozilla Foundation Security Advisory MFSA 2025-88 vom 2025-11-11
  https://www.mozilla.org/en-US/security/advisories/mfsa2025-88/
• Mozilla Foundation Security Advisory MFSA 2025-89 vom 2025-11-11
  https://www.mozilla.org/en-US/security/advisories/mfsa2025-89/
• Red Hat Security Advisory RHSA-2025:21120 vom 2025-11-12
  https://access.redhat.com/errata/RHSA-2025:21120
• Red Hat Security Advisory RHSA-2025:21121 vom 2025-11-12
  https://access.redhat.com/errata/RHSA-2025:21121
• Debian Security Advisory DSA-6054 vom 2025-11-13
  https://lists.debian.org/debian-security-announce/2025/msg00220.html
• IGEL Security Notice ISN-2025-49 vom 2025-11-13
  https://kb.igel.com/en/security-safety/current/isn-2025-49-firefox-esr-vulnerabilities
• Red Hat Security Advisory RHSA-2025:21281 vom 2025-11-13
  https://access.redhat.com/errata/RHSA-2025:21281
• Debian Security Advisory DLA-4370 vom 2025-11-13
  https://lists.debian.org/debian-lts-announce/2025/11/msg00013.html
• Red Hat Security Advisory RHSA-2025:21280 vom 2025-11-13
  https://access.redhat.com/errata/RHSA-2025:21280
• Debian Security Advisory DSA-6059 vom 2025-11-16
  https://lists.debian.org/debian-security-announce/2025/msg00225.html
• Mozilla Security Advisory MFSA2025-90 vom 2025-11-14
  https://www.mozilla.org/en-US/security/advisories/mfsa2025-90/
• Mozilla Security Advisory MFSA2025-91 vom 2025-11-14
  https://www.mozilla.org/en-US/security/advisories/mfsa2025-91/
• openSUSE Security Update OPENSUSE-SU-2025:15735-1 vom 2025-11-15
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WSTH7LYL2RTPD4K7XQ46JBMUE7URLEES/
• Debian Security Advisory DLA-4372 vom 2025-11-16
  https://lists.debian.org/debian-lts-announce/2025/11/msg00015.html
• openSUSE Security Update OPENSUSE-SU-2025:15738-1 vom 2025-11-18
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JISE2HPRC5CFAKTJJW4IV5UCJ63SDLYH/
• Red Hat Security Advisory RHSA-2025:21841 vom 2025-11-20
  https://access.redhat.com/errata/RHSA-2025:21841
• Red Hat Security Advisory RHSA-2025:21843 vom 2025-11-20
  https://access.redhat.com/errata/RHSA-2025:21843
• Red Hat Security Advisory RHSA-2025:21844 vom 2025-11-20
  https://access.redhat.com/errata/RHSA-2025:21844
• Red Hat Security Advisory RHSA-2025:21842 vom 2025-11-20
  https://access.redhat.com/errata/RHSA-2025:21842
• Red Hat Security Advisory RHSA-2025:21881 vom 2025-11-20
  https://access.redhat.com/errata/RHSA-2025:21881
• Rocky Linux Security Advisory RLSA-2025:21881 vom 2025-11-21
  https://errata.build.resf.org/RLSA-2025:21881
• Oracle Linux Security Advisory ELSA-2025-21881 vom 2025-11-21
  https://linux.oracle.com/errata/ELSA-2025-21881.html
• openSUSE Security Update OPENSUSE-SU-2025-20065-1 vom 2025-11-21
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SFEJE33NBZORUUFJM7PNNYUPIRCOD25K/
• Rocky Linux Security Advisory RLSA-2025:21843 vom 2025-11-21
  https://errata.build.resf.org/RLSA-2025:21843
• Rocky Linux Security Advisory RLSA-2025:21281 vom 2025-11-21
  https://errata.build.resf.org/RLSA-2025:21281
• SUSE Security Update SUSE-SU-2025:4195-1 vom 2025-11-24
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/Q2PK2KHBINPYSZXMVGM2YBPSEKS4CYWT/
• Oracle Linux Security Advisory ELSA-2025-21842 vom 2025-11-26
  https://linux.oracle.com/errata/ELSA-2025-21842.html
• SUSE Security Update SUSE-SU-2025:21021-1 vom 2025-11-26
  https://lists.suse.com/pipermail/sle-security-updates/2025-November/023380.html
• Oracle Linux Security Advisory ELSA-2025-21280 vom 2025-11-26
  http://linux.oracle.com/errata/ELSA-2025-21280.html
• Red Hat Security Advisory RHSA-2025:22363 vom 2025-12-01
  https://access.redhat.com/errata/RHSA-2025:22363
• Red Hat Security Advisory RHSA-2025:22368 vom 2025-12-01
  https://access.redhat.com/errata/RHSA-2025:22368
• Red Hat Security Advisory RHSA-2025:22369 vom 2025-12-01
  https://access.redhat.com/errata/RHSA-2025:22369
• Red Hat Security Advisory RHSA-2025:22371 vom 2025-12-01
  https://access.redhat.com/errata/RHSA-2025:22371
• Red Hat Security Advisory RHSA-2025:22372 vom 2025-12-01
  https://access.redhat.com/errata/RHSA-2025:22372
• Red Hat Security Advisory RHSA-2025:22375 vom 2025-12-01
  https://access.redhat.com/errata/RHSA-2025:22375
• Red Hat Security Advisory RHSA-2025:22367 vom 2025-12-01
  https://access.redhat.com/errata/RHSA-2025:22367
• Red Hat Security Advisory RHSA-2025:22373 vom 2025-12-01
  https://access.redhat.com/errata/RHSA-2025:22373
• Red Hat Security Advisory RHSA-2025:22374 vom 2025-12-01
  https://access.redhat.com/errata/RHSA-2025:22374
• Rocky Linux Security Advisory RLSA-2025:22363 vom 2025-12-01
  https://errata.build.resf.org/RLSA-2025:22363
• Red Hat Security Advisory RHSA-2025:22451 vom 2025-12-02
  https://access.redhat.com/errata/RHSA-2025:22451
• Oracle Linux Security Advisory ELSA-2025-22363 vom 2025-12-01
  https://linux.oracle.com/errata/ELSA-2025-22363.html
• Red Hat Security Advisory RHSA-2025:22450 vom 2025-12-01
  https://access.redhat.com/errata/RHSA-2025:22450
• Red Hat Security Advisory RHSA-2025:22449 vom 2025-12-02
  https://access.redhat.com/errata/RHSA-2025:22449
• Oracle Linux Security Advisory ELSA-2025-21843 vom 2025-12-03
  https://linux.oracle.com/errata/ELSA-2025-21843.html
• Oracle Linux Security Advisory ELSA-2025-21281 vom 2025-12-04
  https://linux.oracle.com/errata/ELSA-2025-21281.html
• Red Hat Security Advisory RHSA-2025:22791 vom 2025-12-08
  https://access.redhat.com/errata/RHSA-2025:22791
• Red Hat Security Advisory RHSA-2025:22792 vom 2025-12-08
  https://access.redhat.com/errata/RHSA-2025:22792
• Red Hat Security Advisory RHSA-2025:22883 vom 2025-12-09
  https://access.redhat.com/errata/RHSA-2025:22883
• Amazon Linux Security Advisory ALAS2FIREFOX-2025-047 vom 2025-12-08
  https://alas.aws.amazon.com/AL2/ALAS2FIREFOX-2025-047.html
• Red Hat Security Advisory RHSA-2025:22882 vom 2025-12-09
  https://access.redhat.com/errata/RHSA-2025:22882
• Oracle Linux Security Advisory ELSA-2025-22371 vom 2025-12-16
  http://linux.oracle.com/errata/ELSA-2025-22371.html
• openSUSE Security Update OPENSUSE-SU-2026:20002-1 vom 2026-01-03
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MMMCKXU7B3BYUAEDA466LSIIIZZUSK27/
• Amazon Linux Security Advisory ALAS2-2025-3108 vom 2026-01-05
  https://alas.aws.amazon.com/AL2/ALAS2-2025-3108.html
• Ubuntu Security Notice USN-7991-1 vom 2026-02-03
  https://ubuntu.com/security/notices/USN-7991-1
• Oracle Linux Security Advisory ELSA-2026-2231 vom 2026-02-19
  https://linux.oracle.com/errata/ELSA-2026-2231.html
• Oracle Linux Security Advisory ELSA-2026-3984 vom 2026-06-11
  https://linux.oracle.com/errata/ELSA-2026-3984.html
• Oracle Linux Security Advisory ELSA-2026-8427 vom 2026-06-11
  https://linux.oracle.com/errata/ELSA-2026-8427.html
• Oracle Linux Security Advisory ELSA-2026-13977 vom 2026-06-11
  https://linux.oracle.com/errata/ELSA-2026-13977.html
• Oracle Linux Security Advisory ELSA-2026-22708 vom 2026-06-15
  https://linux.oracle.com/errata/ELSA-2026-22708.html
• Oracle Linux Security Advisory ELSA-2026-19704 vom 2026-06-16
  https://linux.oracle.com/errata/ELSA-2026-19704.html
• Oracle Linux Security Advisory ELSA-2026-24983 vom 2026-06-30
  https://linux.oracle.com/errata/ELSA-2026-24983.html
• Oracle Linux Security Advisory ELSA-2026-26551 vom 2026-06-30
  https://linux.oracle.com/errata/ELSA-2026-26551.html