OESA-2025-1049

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1049
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2025-1049.json
JSON Data
https://api.test.osv.dev/v1/vulns/OESA-2025-1049
Upstream
Published
2025-01-17T14:07:26Z
Modified
2025-08-12T05:48:35.079175Z
Summary
firefox security update
Details

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability.

Security Fix(es):

Assuming a controlled failed memory allocation, an attacker could have caused a use-after-free, leading to a potentially exploitable crash. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, and Firefox ESR < 115.19.(CVE-2025-0238)

When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerability affects Firefox < 134 and Firefox ESR < 128.6.(CVE-2025-0239)

Parsing a JavaScript module as JSON could, under some circumstances, cause cross-compartment access, which may result in a use-after-free. This vulnerability affects Firefox < 134 and Firefox ESR < 128.6.(CVE-2025-0240)

Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 134 and Firefox ESR < 128.6.(CVE-2025-0243)

Database specific 
{
    "severity": "Medium"
}
References

Affected packages

openEuler:24.03-LTS-SP1 / firefox

Package

Name
firefox
Purl
pkg:rpm/openEuler/firefox&distro=openEuler-24.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
128.6.0-1.oe2403sp1

Ecosystem specific 

{
    "src": [
        "firefox-128.6.0-1.oe2403sp1.src.rpm"
    ],
    "x86_64": [
        "firefox-128.6.0-1.oe2403sp1.x86_64.rpm",
        "firefox-debuginfo-128.6.0-1.oe2403sp1.x86_64.rpm",
        "firefox-debugsource-128.6.0-1.oe2403sp1.x86_64.rpm"
    ],
    "aarch64": [
        "firefox-128.6.0-1.oe2403sp1.aarch64.rpm",
        "firefox-debuginfo-128.6.0-1.oe2403sp1.aarch64.rpm",
        "firefox-debugsource-128.6.0-1.oe2403sp1.aarch64.rpm"
    ]
}