This update for MozillaFirefox fixes the following issues:
Update to Mozilla Firefox ESR 128.11 (MFSA 2025-44, bsc#1243353):
- MFSA-TMP-2025-0001: Double-free in libvpx encoder (bmo#1962421)
- CVE-2025-5263: Error handling for script execution was incorrectly isolated from web content (bmo#1960745)
- CVE-2025-5264: Potential local code execution in 'Copy as cURL' command (bmo#1950001)
- CVE-2025-5265: Potential local code execution in 'Copy as cURL' command (bmo#1962301)
- CVE-2025-5266: Script element events leaked cross-origin resource status (bmo#1965628)
- CVE-2025-5267: Clickjacking vulnerability could have led to leaking saved p
This update for MozillaFirefox fixes the following issues:
Update to Firefox Extended Support Release 128.10.1 ESR.
- MFSA 2025-37 (bsc#1243303)
* CVE-2025-4918: Out-of-bounds access when resolving Promise objects
* CVE-2025-4919: Out-of-bounds access when optimizing linear sums
This update for MozillaFirefox fixes the following issues:
- Firefox Extended Support Release 128.10.0 ESR MFSA 2025-29 (bsc#1241621):
* CVE-2025-2817: Potential privilege escalation in Firefox Updater
* CVE-2025-4082: WebGL shader attribute memory corruption in Firefox for macOS
* CVE-2025-4083: Process isolation bypass using `javascript:` URI links in
cross-origin frames
* CVE-2025-4084: Potential local code execution in 'copy as cURL' command
* CVE-2025-4087: Unsafe attribute access during XPath parsing
* CVE-2025-4091: Memory safety bugs fixed in Firefox 138, Thunderbird 138,
Firefox ESR 128.10, and Thunderbird 128.10
This update for MozillaFirefox fixes the following issues:
- Firefox Extended Support Release 128.9.0 ESR MFSA 2025-22 (bsc#1240083):
* CVE-2025-3028: Use-after-free triggered by XSLTProcessor
* CVE-2025-3029: URL Bar Spoofing via non-BMP Unicode characters
* CVE-2025-3030: Memory safety bugs fixed in Firefox 137, Thunderbird 137,
Firefox ESR 128.9, and Thunderbird 128.9
This update for MozillaFirefox fixes the following issues:
Security Vulnerabilities fixed in Firefox ESR 128.8 (MFSA 2025-16) (bsc#1237683)
- CVE-2024-43097: Overflow when growing an SkRegion's RunArray
- CVE-2025-1930: AudioIPC StreamData could trigger a use-after-free in the Browser process
- CVE-2025-1931: Use-after-free in WebTransportChild
- CVE-2025-1932: Inconsistent comparator in XSLT sorting led to out-of-bounds access
- CVE-2025-1933: JIT corruption of WASM i32 return values on 64-bit CPUs
- CVE-2025-1934: Unexpected GC during RegExp bailout processing
- CVE-2025-1935: Clickjacking the registerProtocolHandler info-bar
- CVE-2025-19
This update for MozillaFirefox to 128.7esr fixes the following issues:
* MFSA 2025-09
* CVE-2025-1009 (bmo#1936613)
Use-after-free in XSLT
* CVE-2025-1010 (bmo#1936982)
Use-after-free in Custom Highlight
* CVE-2025-1011 (bmo#1936454)
A bug in WebAssembly code generation could result in a crash
* CVE-2025-1012 (bmo#1939710)
Use-after-free during concurrent delazification
* CVE-2024-11704 (bmo#1899402)
Potential double-free vulnerability in PKCS#7 decryption
handling
* CVE-2025-1013 (bmo#1932555)
Potential opening of private browsing tabs in normal browsing
windows
* CVE-2025-1014 (bmo#1940804)