NLShown in its original language — a full translation is planned for a future version.
Kwetsbaarheden verholpen in Mozilla Firefox en Thunderbird
view advisory published 2025-01-15
Mozilla heeft kwetsbaarheden verholpen in Firefox en Thunderbird (Specifiek voor versies onder 134 en 128.6).
01
describes (14)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-23109US | — | — | ||
Long hostnames in URLs could be leveraged to obscure the actual host of the website or spoof the website address. This vulnerability was fixed in Firefox for iOS 134. | ||||
| CVE-2025-23108US | — | — | ||
Opening Javascript links in a new tab via long-press in the Firefox iOS client could result in a malicious script spoofing the URL of the new tab. This vulnerability was fixed in F… | ||||
| CVE-2025-0247US | — | — | ||
Memory safety bugs present in Firefox 133 and Thunderbird 133. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could ha… | ||||
| CVE-2025-0246US | — | — | ||
When using an invalid protocol scheme, an attacker could spoof the address bar.
*Note: This issue only affected Android operating systems. Other operating systems are unaffected.*… | ||||
| CVE-2025-0245US | —OT elevated | — | ||
Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed. This vulnerability was fixed in Firefox 134. | ||||
| CVE-2025-0244US | — | — | ||
When redirecting to an invalid protocol scheme, an attacker could spoof the address bar.
*Note: This issue only affected Android operating systems. Other operating systems are una… | ||||
| CVE-2025-0243US | — | — | ||
Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that wi… | ||||
| CVE-2025-0242US | — | — | ||
Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18, and Thunderbird 128.5. Some of these bugs showed evidence of… | ||||
| CVE-2025-0241US | — | — | ||
When segmenting specially crafted text, segmentation would corrupt memory leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6… | ||||
| CVE-2025-0240US | — | — | ||
Parsing a JavaScript module as JSON could, under some circumstances, cause cross-compartment access, which may result in a use-after-free. This vulnerability was fixed in Firefox 1… | ||||
| CVE-2025-0239US | — | — | ||
When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerability was fixed in Firefox 134, Firefox ES… | ||||
| CVE-2025-0238US | — | — | ||
Assuming a controlled failed memory allocation, an attacker could have caused a use-after-free, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox… | ||||
| CVE-2025-0237US | —OT elevated | — | ||
The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could ha… | ||||
| CVE-2024-50336US | — | — | ||
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A mali… | ||||
02
references
External citations — patches, advisories, analysis.
- Reference - certbunddeexternal
- Reference - certbunddeexternal
- Reference - certbunddeexternal
- Reference - certbunddeexternal
- Reference - certbunddeexternal
- Reference - certbunddeexternal
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan