Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7 (Mozilla Firefox)
En bref
- Source
- NVD
- EPSS
- EPSS 0.58 % · centile 48 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- mozilla
- Statut NVD
- Modified
Description
Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
Faiblesses (CWE)
- CWE-787 — Écriture hors limites
Références
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=1926256%2C1935984%2C1935471
- https://www.mozilla.org/security/advisories/mfsa2025-07/
- https://www.mozilla.org/security/advisories/mfsa2025-09/
- https://www.mozilla.org/security/advisories/mfsa2025-10/
- https://www.mozilla.org/security/advisories/mfsa2025-11/
- https://lists.debian.org/debian-lts-announce/2025/02/msg00006.html
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2025-1972
- GCVE · GCVE-0-2025-1017
Avis du CERT-FR
- CERTFR-2025-AVI-0756 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0097 — Multiples vulnérabilités dans les produits Mozilla · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*< 128.7.0cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*< 135.0cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*≥ 128.0.1 < 128.7.0cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*≥ 131.0 < 135.0
Produits affectés
| Produit | Versions |
|---|---|
| Mozilla · Firefox | unaffected 128.7 ≤ 128.* ; unaffected 135 ≤ * |
| Mozilla · Thunderbird | unaffected 128.7 ≤ 128.* ; unaffected 135 ≤ * |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |