This update for MozillaFirefox fixes the following issues:
Update to Mozilla Firefox ESR 128.11 (MFSA 2025-44, bsc#1243353):
- MFSA-TMP-2025-0001: Double-free in libvpx encoder (bmo#1962421)
- CVE-2025-5263: Error handling for script execution was incorrectly isolated from web content (bmo#1960745)
- CVE-2025-5264: Potential local code execution in 'Copy as cURL' command (bmo#1950001)
- CVE-2025-5265: Potential local code execution in 'Copy as cURL' command (bmo#1962301)
- CVE-2025-5266: Script element events leaked cross-origin resource status (bmo#1965628)
- CVE-2025-5267: Clickjacking vulnerability could have led to leaking saved p
This update for MozillaFirefox fixes the following issues:
Update to Firefox Extended Support Release 128.10.1 ESR.
- MFSA 2025-37 (bsc#1243303)
* CVE-2025-4918: Out-of-bounds access when resolving Promise objects
* CVE-2025-4919: Out-of-bounds access when optimizing linear sums
This update for MozillaFirefox fixes the following issues:
- Firefox Extended Support Release 128.10.0 ESR MFSA 2025-29 (bsc#1241621):
* CVE-2025-2817: Potential privilege escalation in Firefox Updater
* CVE-2025-4082: WebGL shader attribute memory corruption in Firefox for macOS
* CVE-2025-4083: Process isolation bypass using `javascript:` URI links in
cross-origin frames
* CVE-2025-4084: Potential local code execution in 'copy as cURL' command
* CVE-2025-4087: Unsafe attribute access during XPath parsing
* CVE-2025-4091: Memory safety bugs fixed in Firefox 138, Thunderbird 138,
Firefox ESR 128.10, and Thunderbird 128.10
This update for MozillaFirefox fixes the following issues:
- Firefox Extended Support Release 128.9.0 ESR MFSA 2025-22 (bsc#1240083):
* CVE-2025-3028: Use-after-free triggered by XSLTProcessor
* CVE-2025-3029: URL Bar Spoofing via non-BMP Unicode characters
* CVE-2025-3030: Memory safety bugs fixed in Firefox 137, Thunderbird 137,
Firefox ESR 128.9, and Thunderbird 128.9
This update for MozillaFirefox fixes the following issues:
Security Vulnerabilities fixed in Firefox ESR 128.8 (MFSA 2025-16) (bsc#1237683)
- CVE-2024-43097: Overflow when growing an SkRegion's RunArray
- CVE-2025-1930: AudioIPC StreamData could trigger a use-after-free in the Browser process
- CVE-2025-1931: Use-after-free in WebTransportChild
- CVE-2025-1932: Inconsistent comparator in XSLT sorting led to out-of-bounds access
- CVE-2025-1933: JIT corruption of WASM i32 return values on 64-bit CPUs
- CVE-2025-1934: Unexpected GC during RegExp bailout processing
- CVE-2025-1935: Clickjacking the registerProtocolHandler info-bar
- CVE-2025-19
This update for MozillaFirefox to 128.7esr fixes the following issues:
* MFSA 2025-09
* CVE-2025-1009 (bmo#1936613)
Use-after-free in XSLT
* CVE-2025-1010 (bmo#1936982)
Use-after-free in Custom Highlight
* CVE-2025-1011 (bmo#1936454)
A bug in WebAssembly code generation could result in a crash
* CVE-2025-1012 (bmo#1939710)
Use-after-free during concurrent delazification
* CVE-2024-11704 (bmo#1899402)
Potential double-free vulnerability in PKCS#7 decryption
handling
* CVE-2025-1013 (bmo#1932555)
Potential opening of private browsing tabs in normal browsing
windows
* CVE-2025-1014 (bmo#1940804)
This update for MozillaFirefox fixes the following issues:
Update to Firefox Extended Support Release 128.5.1 ESR (bsc#1234326):
- Fixed an issue that prevented some websites from
loading when using SSL Inspection. (bmo#1933747)
This update for MozillaFirefox fixes the following issues:
Firefox Extended Support Release 128.5.0 ESR, fixed various security fixes
and other quality improvements, MFSA 2024-64 (bsc#1233695):
* CVE-2024-11691: Memory corruption in Apple GPU drivers
* CVE-2024-11692: Select list elements could be shown over another site
* CVE-2024-11693: Download Protections were bypassed by .library-ms files on Windows
* CVE-2024-11694: CSP Bypass and XSS Exposure via Web Compatibility Shims
* CVE-2024-11695: URL Bar Spoofing via Manipulated Punycode and Whitespace Characters
* CVE-2024-11696: Unhandled Exception in Add-on Signature Verification
* CVE-20
This update for MozillaFirefox fixes the following issues:
Firefox Extended Support Release 128.4.0 ESR (bsc#1231879):
- CVE-2024-10458: Permission leak via embed or object elements
- CVE-2024-10459: Use-after-free in layout with accessibility
- CVE-2024-10460: Confusing display of origin for external protocol handler prompt
- CVE-2024-10461: XSS due to Content-Disposition being ignored in multipart/x-mixed-replace response
- CVE-2024-10462: Origin of permission prompt could be spoofed by long URL
- CVE-2024-10463: Cross origin video frame leak
- CVE-2024-10464: History interface could have been used to cause a Denial of Service conditi
This update for MozillaFirefox fixes the following issues:
Update to Firefox Extended Support Release 128.3.1 ESR MFSA 2024-51 (bsc#1231413)
- CVE-2024-9680: Use-after-free in Animation timeline (bmo#1923344)
Also includes the following CVEs from MFSA 2024-47 (bsc#1230979)
- CVE-2024-9392: Compromised content process can bypass site isolation (bmo#1899154, bmo#1905843)
- CVE-2024-9393: Cross-origin access to PDF contents through multipart responses (bmo#1918301)
- CVE-2024-9394: Cross-origin access to JSON contents through multipart responses (bmo#1918874)
- CVE-2024-8900: Clipboard write permission bypass (bmo#1872841)
- CVE-2024-9396
This update for MozillaFirefox fixes the following issues:
Update to Firefox Extended Support Release 128.3.0 ESR (MFSA-2024-47, bsc#1230979):
- CVE-2024-8900: Clipboard write permission bypass
- CVE-2024-9392: Compromised content process can bypass site isolation
- CVE-2024-9393: Cross-origin access to PDF contents through multipart responses
- CVE-2024-9394: Cross-origin access to JSON contents through multipart responses
- CVE-2024-9396: Potential memory corruption may occur when cloning certain objects
- CVE-2024-9397: Potential directory upload bypass via clickjacking
- CVE-2024-9398: External protocol handlers could be enumerat
This update for MozillaFirefox fixes the following issues:
- Update to Firefox Extended Support Release 128.2.0 ESR (bsc#1229821)
- CVE-2024-8381: Type confusion when looking up a property name in a 'with' block
- CVE-2024-8382: Internal event interfaces were exposed to web content when browser EventHandler listener callbacks ran
- CVE-2024-8383: Firefox did not ask before openings news: links in an external application
- CVE-2024-8384: Garbage collection could mis-color cross-compartment objects in OOM conditions
- CVE-2024-8385: WASM type confusion involving ArrayTypes
- CVE-2024-8386: SelectElements could be shown over another site if pop
This update for MozillaFirefox fixes the following issues:
Update to Firefox Extended Support Release 128.1.0 ESR (MFSA 2024-35, bsc#1228648)
- CVE-2024-7518: Fullscreen notification dialog can be obscured by document
- CVE-2024-7519: Out of bounds memory access in graphics shared memory handling
- CVE-2024-7520: Type confusion in WebAssembly
- CVE-2024-7521: Incomplete WebAssembly exception handing
- CVE-2024-7522: Out of bounds read in editor component
- CVE-2024-7524: CSP strict-dynamic bypass using web-compatibility shims
- CVE-2024-7525: Missing permission check when creating a StreamFilter
- CVE-2024-7526: Uninitial
This update for MozillaFirefox fixes the following issues:
Update to Firefox Extended Support Release 115.13.0 ESR (MFSA 2024-30, bsc#1226316):
- CVE-2024-6600: Memory corruption in WebGL API
- CVE-2024-6601: Race condition in permission assignment
- CVE-2024-6602: Memory corruption in NSS
- CVE-2024-6603: Memory corruption in thread creation
- CVE-2024-6604: Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, and Thunderbird 115.13
Other fixes:
- Fix GNOME search provider (bsc#1225278)
This update for MozillaFirefox fixes the following issues:
- Update to version 115.12.0 ESR (bsc#1226027)
- CVE-2024-5702: Use-after-free in networking
- CVE-2024-5688: Use-after-free in JavaScript object transplant
- CVE-2024-5690: External protocol handlers leaked by timing attack
- CVE-2024-5691: Sandboxed iframes were able to bypass sandbox restrictions to open a new window
- CVE-2024-5692: Bypass of file name restrictions during saving
- CVE-2024-5693: Cross-Origin Image leak via Offscreen Canvas
- CVE-2024-5696: Memory Corruption in Text Fragments
- CVE-2024-5700: Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12, and Thunder
This update for MozillaFirefox fixes the following issues:
Update to version 115.11.0 ESR (bsc#1224056):
- CVE-2024-4367: Arbitrary JavaScript execution in PDF.js
- CVE-2024-4767: IndexedDB files retained in private browsing mode
- CVE-2024-4768: Potential permissions request bypass via clickjacking
- CVE-2024-4769: Cross-origin responses could be distinguished between script and non-script content-types
- CVE-2024-4770: Use-after-free could occur when printing to PDF
- CVE-2024-4777: Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11
This update for MozillaFirefox fixes the following issues:
Update to Firefox Extended Support Release 115.10.0 ESR (MSFA 2024-19) (bsc#1222535):
- CVE-2024-3852: GetBoundName in the JIT returned the wrong object
- CVE-2024-3854: Out-of-bounds-read after mis-optimized switch statement
- CVE-2024-3857: Incorrect JITting of arguments led to use-after-free during garbage collection
- CVE-2024-2609: Permission prompt input delay could expire when not in focus
- CVE-2024-3859: Integer-overflow led to out-of-bounds-read in the OpenType sanitizer
- CVE-2024-3861: Potential use-after-free due to AlignedBuffer self-move
- CVE-2024-3863:
This update for MozillaFirefox fixes the following issues:
Firefox Extended Support Release 115.9.1esr ESR MFSA 2024-16 (bsc#1221850).
- CVE-2024-29944: Privileged JavaScript Execution via Event Handlers (bmo#1886852).
Firefox Extended Support Release 115.9.0 ESR (bsc#1221327):
- CVE-2024-0743: Crash in NSS TLS method (bmo#1867408).
- CVE-2024-2605: Windows Error Reporter could be used as a Sandbox escape
vector (bmo#1872920).
- CVE-2024-2607: JIT code failed to save return registers on Armv7-A (bmo#1879939).
- CVE-2024-2608: Integer overflow could have led to out of bounds write (bmo#1880692).
- CVE-2024-2616: Improve handli
This update for MozillaFirefox fixes the following issues:
Update to Firefox Extended Support Release 115.8.0 ESR (MFSA 2024-06) (bsc#1220048):
- CVE-2024-1546: Out-of-bounds memory read in networking channels
- CVE-2024-1547: Alert dialog could have been spoofed on another site
- CVE-2024-1548: Fullscreen Notification could have been hidden by select element
- CVE-2024-1549: Custom cursor could obscure the permission dialog
- CVE-2024-1550: Mouse cursor re-positioned unexpectedly could have led to unintended permission grants
- CVE-2024-1551: Multipart HTTP Responses would accept the Set-Cookie header in response parts
- CVE-2024-1552: Inc