Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8 (Mozilla Firefox)
En bref
- Source
- NVD
- EPSS
- EPSS 0.56 % · centile 47 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- mozilla
- Statut NVD
- Modified
Rechercher sur…
Description
Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 136, Firefox ESR 115.21, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.
Faiblesses (CWE)
- CWE-1260 — Improper Handling of Overlap Between Protected Memory Ranges
Références
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=1938471%2C1940716
- https://www.mozilla.org/security/advisories/mfsa2025-14/
- https://www.mozilla.org/security/advisories/mfsa2025-15/
- https://www.mozilla.org/security/advisories/mfsa2025-16/
- https://www.mozilla.org/security/advisories/mfsa2025-17/
- https://www.mozilla.org/security/advisories/mfsa2025-18/
- http://www.openwall.com/lists/oss-security/2025/03/10/6
- https://lists.debian.org/debian-lts-announce/2025/03/msg00006.html
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H | CISA-ADP |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2025-6082
- GCVE · GCVE-0-2025-1937
Avis du CERT-FR
- CERTFR-2025-AVI-0756 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0176 — Multiples vulnérabilités dans les produits Mozilla · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*< 115.21.0cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*< 128.8.0cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*< 135.0cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*< 128.8.0cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*≥ 129.0 < 136.0
Produits affectés
| Produit | Versions |
|---|---|
| Mozilla · Firefox | unaffected 115.21 ≤ 115.* ; unaffected 128.8 ≤ 128.* ; unaffected 136 ≤ * |
| Mozilla · Thunderbird | unaffected 128.8 ≤ 128.* ; unaffected 136 ≤ * |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |