Mozilla Firefox: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 13

• Critical 9.8
  CVE-2025-14321 Public exploit

  Use-after-free in the WebRTC: Signaling component

  Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Dec 9, 2025
• Critical 9.8
  CVE-2025-14324

  JIT miscompilation in the JavaScript Engine: JIT component

  JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Dec 9, 2025
• Critical 9.8
  CVE-2025-14326

  Use-after-free in the Audio/Video: GMP component

  Use-after-free in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 146 and Thunderbird 146.

  Mozilla Firefox Thunderbird firefox Browsers Wolfi
  Dec 9, 2025
• Critical 9.8
  CVE-2025-14330

  JIT miscompilation in the JavaScript Engine: JIT component

  JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Dec 9, 2025
• High 8.8
  CVE-2025-14323

  Privilege escalation in the DOM: Notifications component

  Privilege escalation in the DOM: Notifications component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Dec 9, 2025
• High 8.8
  CVE-2025-14328

  Privilege escalation in the Netmonitor component

  Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Dec 9, 2025
• High 8.8
  CVE-2025-14329

  Privilege escalation in the Netmonitor component

  Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Dec 9, 2025
• High 8.1
  CVE-2025-14333

  Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146

  Memory safety bugs present in Firefox ESR 140.5, Thunderbird ESR 140.5, Firefox 145 and Thunderbird 145. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary co…

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Dec 9, 2025
• High 8.0
  CVE-2025-14322

  Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component

  Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Dec 9, 2025
• High 7.5
  CVE-2025-14327

  Spoofing issue in the Downloads Panel component

  Spoofing issue in the Downloads Panel component. This vulnerability was fixed in Firefox 146, Thunderbird 146, Firefox ESR 140.7, and Thunderbird 140.7.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Dec 9, 2025
• High 7.3
  CVE-2025-14325 Public exploit

  JIT miscompilation in the JavaScript Engine: JIT component

  JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Dec 9, 2025
• High 7.3
  CVE-2025-14332

  Memory safety bugs fixed in Firefox 146 and Thunderbird 146

  Memory safety bugs present in Firefox 145 and Thunderbird 145. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefo…

  Mozilla Firefox Thunderbird mozjs38 Browsers Ubuntu Wolfi
  Dec 9, 2025
• Medium 6.5
  CVE-2025-14331

  Same-origin policy bypass in the Request Handling component

  Same-origin policy bypass in the Request Handling component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Dec 9, 2025

Revision history

1. 2026-11-05 #29

   Neue Updates von Oracle Linux aufgenommen

2. 2026-09-21 #28

   Neue Updates von Oracle Linux aufgenommen

3. 2026-06-30 #27

   Neue Updates von Oracle Linux aufgenommen

4. 2026-06-15 #26

   Neue Updates von Oracle Linux aufgenommen

5. 2026-06-11 #25

   Neue Updates von Oracle Linux aufgenommen

6. 2026-06-10 #24

   Neue Updates von Oracle Linux aufgenommen

7. 2026-02-18 #23

   Neue Updates von Amazon und Oracle Linux aufgenommen

8. 2026-02-04 #22

   Neue Updates von Red Hat aufgenommen

9. 2026-02-02 #21

   Neue Updates von Ubuntu aufgenommen

10. 2026-01-28 #20

    Neue Updates von Red Hat aufgenommen

11. 2026-01-27 #19

    Neue Updates von Red Hat aufgenommen

12. 2026-01-26 #18

    Neue Updates von Red Hat aufgenommen

13. 2026-01-22 #17

    Neue Updates von SUSE aufgenommen

14. 2026-01-21 #16

    Neue Updates von Red Hat aufgenommen

15. 2026-01-19 #15

    Neue Updates von Debian aufgenommen

16. 2026-01-18 #14

    Neue Updates von Debian, openSUSE und Oracle Linux aufgenommen

17. 2026-01-15 #13

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

18. 2026-01-14 #12

    Neue Updates von openSUSE, SUSE und Red Hat aufgenommen

19. 2026-01-13 #11

    Neue Updates von openSUSE aufgenommen

20. 2026-01-06 #10

    Referenz(en) aufgenommen: 2420502, 2420503, 2420504, 2420506, 2420508, 2420509, 2420512, 2420513, 2420516, 2420517

21. 2026-01-05 #9

    Neue Updates von Amazon und Oracle Linux aufgenommen

22. 2026-01-04 #8

    Neue Updates von Red Hat aufgenommen

23. 2025-12-22 #7

    Neue Updates von Red Hat und Oracle Linux aufgenommen

24. 2025-12-17 #6

    Neue Updates von SUSE aufgenommen

25. 2025-12-15 #5

    Neue Updates von SUSE aufgenommen

References

• SUSE Security Update SUSE-SU-2025:4397-1 vom 2025-12-15
  https://lists.suse.com/pipermail/sle-security-updates/2025-December/023540.html
• SUSE Security Update SUSE-SU-2025:4396-1 vom 2025-12-15
  https://lists.suse.com/pipermail/sle-security-updates/2025-December/023541.html
• Mozilla Security Advisory 2025-92 vom 2025-12-09
  https://www.mozilla.org/en-US/security/advisories/mfsa2025-92/
• Mozilla Security Advisory 2025-93 vom 2025-12-09
  https://www.mozilla.org/en-US/security/advisories/mfsa2025-93/
• Mozilla Security Advisory 2025-94 vom 2025-12-09
  https://www.mozilla.org/en-US/security/advisories/mfsa2025-94/
• Oracle Linux Security Advisory ELSA-2025-23035 vom 2025-12-11
  http://linux.oracle.com/errata/ELSA-2025-23035.html
• Oracle Linux Security Advisory ELSA-2025-23034 vom 2025-12-11
  http://linux.oracle.com/errata/ELSA-2025-23034.html
• Debian Security Advisory DSA-6078 vom 2025-12-11
  https://lists.debian.org/debian-security-announce/2025/msg00244.html
• Red Hat Security Advisory RHSA-2025:23035 vom 2025-12-10
  https://access.redhat.com/errata/RHSA-2025:23035
• Rocky Linux Security Advisory RLSA-2025:23035 vom 2025-12-11
  https://errata.build.resf.org/RLSA-2025:23035
• Rocky Linux Security Advisory RLSA-2025:23034 vom 2025-12-11
  https://errata.build.resf.org/RLSA-2025:23034
• Red Hat Security Advisory RHSA-2025:23034 vom 2025-12-10
  https://access.redhat.com/errata/RHSA-2025:23034
• Mozilla Security Advisory MFSA2025-95 vom 2025-12-10
  https://www.mozilla.org/en-US/security/advisories/mfsa2025-95/
• Mozilla Security Advisory MFSA2025-96 vom 2025-12-10
  https://www.mozilla.org/en-US/security/advisories/mfsa2025-96/
• Debian Security Advisory DLA-4401 vom 2025-12-11
  https://lists.debian.org/debian-lts-announce/2025/12/msg00012.html
• Red Hat Security Advisory RHSA-2025:23128 vom 2025-12-11
  https://access.redhat.com/errata/RHSA-2025:23128
• Oracle Linux Security Advisory ELSA-2025-23128 vom 2025-12-12
  http://linux.oracle.com/errata/ELSA-2025-23128.html
• Rocky Linux Security Advisory RLSA-2025:23128 vom 2025-12-12
  https://errata.build.resf.org/RLSA-2025:23128
• Debian Security Advisory DSA-6081 vom 2025-12-14
  https://lists.debian.org/debian-security-announce/2025/msg00247.html
• Debian Security Advisory DLA-4405 vom 2025-12-13
  https://lists.debian.org/debian-lts-announce/2025/12/msg00016.html
• openSUSE Security Update OPENSUSE-SU-2025:15814-1 vom 2025-12-12
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/T4EMUHVJOMDPCPIQCOEUD2MFVGP2JHD7/
• openSUSE Security Update OPENSUSE-SU-2025:15813-1 vom 2025-12-12
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KRSP6N5KCV6RB2RJHYPXMO2WHHL27FE5/
• SUSE Security Update SUSE-SU-2025:4424-1 vom 2025-12-17
  https://lists.suse.com/pipermail/sle-security-updates/2025-December/023571.html
• Red Hat Security Advisory RHSA-2025:23856 vom 2025-12-22
  https://access.redhat.com/errata/RHSA-2025:23856
• Oracle Linux Security Advisory ELSA-2025-23856 vom 2025-12-23
  https://linux.oracle.com/errata/ELSA-2025-23856.html
• Rocky Linux Security Advisory RLSA-2025:23856 vom 2025-12-23
  https://errata.build.resf.org/RLSA-2025:23856
• Red Hat Security Advisory RHSA-2026:0014 vom 2026-01-05
  https://access.redhat.com/errata/RHSA-2026:0014
• Red Hat Security Advisory RHSA-2026:0015 vom 2026-01-05
  https://access.redhat.com/errata/RHSA-2026:0015
• Red Hat Security Advisory RHSA-2026:0016 vom 2026-01-05
  https://access.redhat.com/errata/RHSA-2026:0016
• Red Hat Security Advisory RHSA-2026:0017 vom 2026-01-05
  https://access.redhat.com/errata/RHSA-2026:0017
• Red Hat Security Advisory RHSA-2026:0018 vom 2026-01-05
  https://access.redhat.com/errata/RHSA-2026:0018
• Red Hat Security Advisory RHSA-2026:0019 vom 2026-01-05
  https://access.redhat.com/errata/RHSA-2026:0019
• Red Hat Security Advisory RHSA-2026:0020 vom 2026-01-05
  https://access.redhat.com/errata/RHSA-2026:0020
• Red Hat Security Advisory RHSA-2026:0021 vom 2026-01-05
  https://access.redhat.com/errata/RHSA-2026:0021
• Red Hat Security Advisory RHSA-2026:0022 vom 2026-01-05
  https://access.redhat.com/errata/RHSA-2026:0022
• Red Hat Security Advisory RHSA-2026:0023 vom 2026-01-05
  https://access.redhat.com/errata/RHSA-2026:0023
• Red Hat Security Advisory RHSA-2026:0026 vom 2026-01-05
  https://access.redhat.com/errata/RHSA-2026:0026
• Red Hat Security Advisory RHSA-2026:0003 vom 2026-01-05
  https://access.redhat.com/errata/RHSA-2026:0003
• Red Hat Security Advisory RHSA-2026:0024 vom 2026-01-05
  https://access.redhat.com/errata/RHSA-2026:0024
• Red Hat Security Advisory RHSA-2026:0025 vom 2026-01-05
  https://access.redhat.com/errata/RHSA-2026:0025
• Red Hat Security Advisory RHSA-2026:0005 vom 2026-01-05
  https://access.redhat.com/errata/RHSA-2026:0005
• Red Hat Security Advisory RHSA-2026:0006 vom 2026-01-05
  https://access.redhat.com/errata/RHSA-2026:0006
• Red Hat Security Advisory RHSA-2026:0007 vom 2026-01-05
  https://access.redhat.com/errata/RHSA-2026:0007
• Red Hat Security Advisory RHSA-2026:0004 vom 2026-01-05
  https://access.redhat.com/errata/RHSA-2026:0004
• Red Hat Security Advisory RHSA-2026:0013 vom 2026-01-05
  https://access.redhat.com/errata/RHSA-2026:0013
• Rocky Linux Security Advisory RLSA-2026:0025 vom 2026-01-05
  https://errata.build.resf.org/RLSA-2026:0025
• Rocky Linux Security Advisory RLSA-2026:0026 vom 2026-01-05
  https://errata.build.resf.org/RLSA-2026:0026
• Amazon Linux Security Advisory ALAS2-2025-3108 vom 2026-01-05
  https://alas.aws.amazon.com/AL2/ALAS2-2025-3108.html
• Amazon Linux Security Advisory ALAS2FIREFOX-2025-049 vom 2026-01-05
  https://alas.aws.amazon.com/AL2/ALAS2FIREFOX-2025-049.html
• Oracle Linux Security Advisory ELSA-2026-0026 vom 2026-01-06
  https://linux.oracle.com/errata/ELSA-2026-0026.html
• Oracle Linux Security Advisory ELSA-2026-0025 vom 2026-01-06
  https://linux.oracle.com/errata/ELSA-2026-0025.html
• Red Hat Security Advisory RHSA-2026:0127 vom 2026-01-06
  https://access.redhat.com/errata/RHSA-2026:0127
• Red Hat Security Advisory RHSA-2026:0124 vom 2026-01-06
  https://access.redhat.com/errata/RHSA-2026:0124
• openSUSE Security Update OPENSUSE-SU-2026:20014-1 vom 2026-01-13
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4JM3KI26O5XDVLVJNGJ4TY43UE6YNZNT/
• openSUSE Security Update OPENSUSE-SU-2026:10037-1 vom 2026-01-14
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MWE7GIFYIBLX76K6B34TZZ67PXOQMQY6/
• SUSE Security Update SUSE-SU-2026:0122-1 vom 2026-01-14
  https://lists.suse.com/pipermail/sle-security-updates/2026-January/023741.html
• Red Hat Security Advisory RHSA-2026:0667 vom 2026-01-15
  https://access.redhat.com/errata/RHSA-2026:0667
• SUSE Security Update SUSE-SU-2026:20031-1 vom 2026-01-15
  https://lists.suse.com/pipermail/sle-security-updates/2026-January/023773.html
• Red Hat Security Advisory RHSA-2026:0694 vom 2026-01-15
  https://access.redhat.com/errata/RHSA-2026:0694
• Rocky Linux Security Advisory RLSA-2026:0667 vom 2026-01-16
  https://errata.build.resf.org/RLSA-2026:0667
• Rocky Linux Security Advisory RLSA-2026:0694 vom 2026-01-16
  https://errata.build.resf.org/RLSA-2026:0694
• Oracle Linux Security Advisory ELSA-2026-0007 vom 2026-01-16
  https://linux.oracle.com/errata/ELSA-2026-0007.html
• Debian Security Advisory DSA-6103 vom 2026-01-17
  https://lists.debian.org/debian-security-announce/2026/msg00011.html
• openSUSE Security Update OPENSUSE-SU-2026:20046-1 vom 2026-01-17
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/L4ACYE75IJMRZVX4KYDMPFIVVY5T4I4U/
• Oracle Linux Security Advisory ELSA-2026-0667 vom 2026-01-16
  https://linux.oracle.com/errata/ELSA-2026-0667.html
• Oracle Linux Security Advisory ELSA-2026-0694 vom 2026-01-16
  https://linux.oracle.com/errata/ELSA-2026-0694.html
• Debian Security Advisory DLA-4442 vom 2026-01-19
  https://lists.debian.org/debian-lts-announce/2026/01/msg00013.html
• Red Hat Security Advisory RHSA-2026:0924 vom 2026-01-21
  https://access.redhat.com/errata/RHSA-2026:0924
• SUSE Security Update SUSE-SU-2026:0260-1 vom 2026-01-23
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VOTCXXVYDWXM7Y4N2D6ZBPDRGOEE7KPT/
• Red Hat Security Advisory RHSA-2026:1320 vom 2026-01-27
  https://access.redhat.com/errata/RHSA-2026:1320
• Red Hat Security Advisory RHSA-2026:1415 vom 2026-01-27
  https://access.redhat.com/errata/RHSA-2026:1415
• Red Hat Security Advisory RHSA-2026:1471 vom 2026-01-28
  https://access.redhat.com/errata/RHSA-2026:1471
• Red Hat Security Advisory RHSA-2026:1462 vom 2026-01-28
  https://access.redhat.com/errata/RHSA-2026:1462
• Red Hat Security Advisory RHSA-2026:1461 vom 2026-01-28
  https://access.redhat.com/errata/RHSA-2026:1461
• Red Hat Security Advisory RHSA-2026:1414 vom 2026-01-27
  https://access.redhat.com/errata/RHSA-2026:1414
• Red Hat Security Advisory RHSA-2026:1413 vom 2026-01-27
  https://access.redhat.com/errata/RHSA-2026:1413
• Red Hat Security Advisory RHSA-2026:1487 vom 2026-01-28
  https://access.redhat.com/errata/RHSA-2026:1487
• Ubuntu Security Notice USN-7991-1 vom 2026-02-03
  https://ubuntu.com/security/notices/USN-7991-1
• Red Hat Security Advisory RHSA-2026:2041 vom 2026-02-05
  https://access.redhat.com/errata/RHSA-2026:2041
• Amazon Linux Security Advisory ALAS2-2026-3167 vom 2026-02-19
  https://alas.aws.amazon.com/AL2/ALAS2-2026-3167.html