DeutschShown in its original language — a full translation is planned for a future version.
Mozilla Firefox und Thunderbird: Mehrere Schwachstellen
view advisory published 2025-02-04
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Mozilla Firefox, Mozilla Firefox ESR und Mozilla Thunderbird ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen preiszugeben, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen oder Spoofing-Angriffe durchzuführen.
01
describes (15)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-1020US | critical9.8 | — | ||
Memory safety bugs present in Firefox 134 and Thunderbird 134. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could ha… | ||||
| CVE-2025-1019US | medium4.3 | — | ||
The z-order of the browser windows could be manipulated to hide the fullscreen notification. This could potentially be leveraged to perform a spoofing attack. This vulnerability wa… | ||||
| CVE-2025-1018US | medium5.3 | — | ||
The fullscreen notification is prematurely hidden when fullscreen is re-requested quickly by the user. This could have been leveraged to perform a potential spoofing attack. This v… | ||||
| CVE-2025-1017US | critical9.8 | — | ||
Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that wi… | ||||
| CVE-2025-1016US | critical9.8 | — | ||
Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6. Some of these bugs showed evidence of… | ||||
| CVE-2025-1015US | medium5.4 | Exploit | ||
The Thunderbird Address Book URI fields contained unsanitized links. This could be used by an attacker to create and export an address book containing a malicious payload in a fiel… | ||||
| CVE-2025-1014US | high8.8 | — | ||
Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed. This vulnerability was fixed in Firefox 135, Firefox ESR… | ||||
| CVE-2025-1013US | — | — | ||
A race condition could have led to private browsing tabs being opened in normal browsing windows. This could have resulted in a potential privacy leak. This vulnerability was fixed… | ||||
| CVE-2025-1012US | high7.5 | — | ||
A race during concurrent delazification could have led to a use-after-free. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, a… | ||||
| CVE-2025-1011US | high8.8 | — | ||
A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code execution. This vulnerability was fixed… | ||||
| CVE-2025-1010US | high8.8 | — | ||
An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 135, Firefox ESR 11… | ||||
| CVE-2025-1009US | critical9.8 | — | ||
An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, F… | ||||
| CVE-2025-0510US | medium6.5OT elevated | — | ||
Thunderbird displayed an incorrect sender address if the From field of an email used the invalid group name syntax that is described in CVE-2024-49040. This vulnerability was fixed… | ||||
| CVE-2024-11704US | — | — | ||
A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path. Under specific conditions, the same symmetric key could have been freed… | ||||
| CVE-2024-49040US | — | — | ||
Microsoft Exchange Server Spoofing Vulnerability | ||||
02
references
External citations — patches, advisories, analysis.
- Oracle Linux Security Advisory ELSA-2025-1184 vom 2025-02-10external
- Red Hat Security Advisory RHSA-2025:1066 vom 2025-02-05external
- Red Hat Security Advisory RHSA-2025:1132 vom 2025-02-06external
- Red Hat Security Advisory RHSA-2025:1133 vom 2025-02-06external
- Red Hat Security Advisory RHSA-2025:1135 vom 2025-02-06external
- Red Hat Security Advisory RHSA-2025:1136 vom 2025-02-06external
- Red Hat Security Advisory RHSA-2025:1137 vom 2025-02-06external
- Red Hat Security Advisory RHSA-2025:1138 vom 2025-02-06external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan