{
	"document":{
		"aggregate_severity":{
			"namespace":"https://nvd.nist.gov/vuln-metrics/cvss",
			"text":"Critical"
		},
		"category":"csaf_vex",
		"csaf_version":"2.0",
		"distribution":{
			"tlp":{
				"label":"WHITE",
				"url":"https:/www.first.org/tlp/"
			}
		},
		"lang":"en",
		"notes":[
			{
				"text":"firefox security update",
				"category":"general",
				"title":"Synopsis"
			},
			{
				"text":"An update for firefox is now available for openEuler-24.03-LTS",
				"category":"general",
				"title":"Summary"
			},
			{
				"text":"Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability.\n\nSecurity Fix(es):\n\nAn attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.(CVE-2025-1009)\n\nAn attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.(CVE-2025-1010)\n\nA bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code execution. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.(CVE-2025-1011)\n\nA race during concurrent delazification could have led to a use-after-free. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.(CVE-2025-1012)\n\nA race condition could have led to private browsing tabs being opened in normal browsing windows. This could have resulted in a potential privacy leak. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.(CVE-2025-1013)\n\nCertificate length was not properly checked when added to a certificate store. In practice only trusted data was processed. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.(CVE-2025-1014)\n\nMemory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.(CVE-2025-1017)",
				"category":"general",
				"title":"Description"
			},
			{
				"text":"An update for firefox is now available for master/openEuler-20.03-LTS-SP4/openEuler-22.03-LTS-SP3/openEuler-24.03-LTS/openEuler-24.03-LTS-Next/openEuler-22.03-LTS-SP4/openEuler-24.03-LTS-SP1.\n\nopenEuler Security has rated this update as having a security impact of critical. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.",
				"category":"general",
				"title":"Topic"
			},
			{
				"text":"Critical",
				"category":"general",
				"title":"Severity"
			},
			{
				"text":"firefox",
				"category":"general",
				"title":"Affected Component"
			}
		],
		"publisher":{
			"issuing_authority":"openEuler security committee",
			"name":"openEuler",
			"namespace":"https://www.openeuler.org",
			"contact_details":"openeuler-security@openeuler.org",
			"category":"vendor"
		},
		"references":[
			{
				"summary":"openEuler-SA-2025-1101",
				"category":"self",
				"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1101"
			},
			{
				"summary":"CVE-2025-1009",
				"category":"self",
				"url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-1009&packageName=firefox"
			},
			{
				"summary":"CVE-2025-1010",
				"category":"self",
				"url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-1010&packageName=firefox"
			},
			{
				"summary":"CVE-2025-1011",
				"category":"self",
				"url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-1011&packageName=firefox"
			},
			{
				"summary":"CVE-2025-1012",
				"category":"self",
				"url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-1012&packageName=firefox"
			},
			{
				"summary":"CVE-2025-1013",
				"category":"self",
				"url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-1013&packageName=firefox"
			},
			{
				"summary":"CVE-2025-1014",
				"category":"self",
				"url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-1014&packageName=firefox"
			},
			{
				"summary":"CVE-2025-1017",
				"category":"self",
				"url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-1017&packageName=firefox"
			},
			{
				"summary":"nvd cve",
				"category":"external",
				"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1009"
			},
			{
				"summary":"nvd cve",
				"category":"external",
				"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1010"
			},
			{
				"summary":"nvd cve",
				"category":"external",
				"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1011"
			},
			{
				"summary":"nvd cve",
				"category":"external",
				"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1012"
			},
			{
				"summary":"nvd cve",
				"category":"external",
				"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1013"
			},
			{
				"summary":"nvd cve",
				"category":"external",
				"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1014"
			},
			{
				"summary":"nvd cve",
				"category":"external",
				"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1017"
			},
			{
				"summary":"openEuler-SA-2025-1101 vex file",
				"category":"self",
				"url":"https://repo.openeuler.org/security/data/csaf/advisories/2025/csaf-openeuler-sa-2025-1101.json"
			}
		],
		"title":"An update for firefox is now available for openEuler-24.03-LTS",
		"tracking":{
			"initial_release_date":"2025-02-08T20:33:47+08:00",
			"revision_history":[
				{
					"date":"2025-02-08T20:33:47+08:00",
					"summary":"Initial",
					"number":"1.0.0"
				}
			],
			"generator":{
				"date":"2025-02-08T20:33:47+08:00",
				"engine":{
					"name":"openEuler CSAF Tool V1.0"
				}
			},
			"current_release_date":"2025-02-08T20:33:47+08:00",
			"id":"openEuler-SA-2025-1101",
			"version":"1.0.0",
			"status":"final"
		}
	},
	"product_tree":{
		"branches":[
			{
				"name":"openEuler",
				"category":"vendor",
				"branches":[
					{
						"name":"openEuler",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS"
									},
									"product_id":"openEuler-24.03-LTS",
									"name":"openEuler-24.03-LTS"
								},
								"name":"openEuler-24.03-LTS",
								"category":"product_version"
							}
						],
						"category":"product_name"
					},
					{
						"name":"src",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS"
									},
									"product_id":"firefox-128.7.0-1.oe2403.src.rpm",
									"name":"firefox-128.7.0-1.oe2403.src.rpm"
								},
								"name":"firefox-128.7.0-1.oe2403.src.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					},
					{
						"name":"x86_64",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS"
									},
									"product_id":"firefox-128.7.0-1.oe2403.x86_64.rpm",
									"name":"firefox-128.7.0-1.oe2403.x86_64.rpm"
								},
								"name":"firefox-128.7.0-1.oe2403.x86_64.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS"
									},
									"product_id":"firefox-debuginfo-128.7.0-1.oe2403.x86_64.rpm",
									"name":"firefox-debuginfo-128.7.0-1.oe2403.x86_64.rpm"
								},
								"name":"firefox-debuginfo-128.7.0-1.oe2403.x86_64.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS"
									},
									"product_id":"firefox-debugsource-128.7.0-1.oe2403.x86_64.rpm",
									"name":"firefox-debugsource-128.7.0-1.oe2403.x86_64.rpm"
								},
								"name":"firefox-debugsource-128.7.0-1.oe2403.x86_64.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					},
					{
						"name":"aarch64",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS"
									},
									"product_id":"firefox-128.7.0-1.oe2403.aarch64.rpm",
									"name":"firefox-128.7.0-1.oe2403.aarch64.rpm"
								},
								"name":"firefox-128.7.0-1.oe2403.aarch64.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS"
									},
									"product_id":"firefox-debuginfo-128.7.0-1.oe2403.aarch64.rpm",
									"name":"firefox-debuginfo-128.7.0-1.oe2403.aarch64.rpm"
								},
								"name":"firefox-debuginfo-128.7.0-1.oe2403.aarch64.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS"
									},
									"product_id":"firefox-debugsource-128.7.0-1.oe2403.aarch64.rpm",
									"name":"firefox-debugsource-128.7.0-1.oe2403.aarch64.rpm"
								},
								"name":"firefox-debugsource-128.7.0-1.oe2403.aarch64.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					}
				]
			}
		],
		"relationships":[
			{
				"relates_to_product_reference":"openEuler-24.03-LTS",
				"product_reference":"firefox-128.7.0-1.oe2403.src.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.src",
					"name":"firefox-128.7.0-1.oe2403.src as a component of openEuler-24.03-LTS"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS",
				"product_reference":"firefox-128.7.0-1.oe2403.x86_64.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.x86_64",
					"name":"firefox-128.7.0-1.oe2403.x86_64 as a component of openEuler-24.03-LTS"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS",
				"product_reference":"firefox-debuginfo-128.7.0-1.oe2403.x86_64.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.x86_64",
					"name":"firefox-debuginfo-128.7.0-1.oe2403.x86_64 as a component of openEuler-24.03-LTS"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS",
				"product_reference":"firefox-debugsource-128.7.0-1.oe2403.x86_64.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.x86_64",
					"name":"firefox-debugsource-128.7.0-1.oe2403.x86_64 as a component of openEuler-24.03-LTS"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS",
				"product_reference":"firefox-128.7.0-1.oe2403.aarch64.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.aarch64",
					"name":"firefox-128.7.0-1.oe2403.aarch64 as a component of openEuler-24.03-LTS"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS",
				"product_reference":"firefox-debuginfo-128.7.0-1.oe2403.aarch64.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.aarch64",
					"name":"firefox-debuginfo-128.7.0-1.oe2403.aarch64 as a component of openEuler-24.03-LTS"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS",
				"product_reference":"firefox-debugsource-128.7.0-1.oe2403.aarch64.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.aarch64",
					"name":"firefox-debugsource-128.7.0-1.oe2403.aarch64 as a component of openEuler-24.03-LTS"
				},
				"category":"default_component_of"
			}
		]
	},
	"vulnerabilities":[
		{
			"cve":"CVE-2025-1009",
			"notes":[
				{
					"text":"An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.",
					"category":"description",
					"title":"Vulnerability Description"
				}
			],
			"product_status":{
				"fixed":[
					"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.src",
					"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.x86_64",
					"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.x86_64",
					"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.x86_64",
					"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.aarch64",
					"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.aarch64",
					"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.aarch64"
				]
			},
			"remediations":[
				{
					"product_ids":[
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.src",
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.aarch64",
						"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.aarch64",
						"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.aarch64"
					],
					"details":"firefox security update",
					"category":"vendor_fix",
					"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1101"
				}
			],
			"scores":[
				{
					"cvss_v3":{
						"baseSeverity":"CRITICAL",
						"baseScore":9.8,
						"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
						"version":"3.1"
					},
					"products":[
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.src",
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.aarch64",
						"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.aarch64",
						"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.aarch64"
					]
				}
			],
			"threats":[
				{
					"details":"Critical",
					"category":"impact"
				}
			],
			"title":"CVE-2025-1009"
		},
		{
			"cve":"CVE-2025-1010",
			"notes":[
				{
					"text":"An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.",
					"category":"description",
					"title":"Vulnerability Description"
				}
			],
			"product_status":{
				"fixed":[
					"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.src",
					"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.x86_64",
					"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.x86_64",
					"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.x86_64",
					"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.aarch64",
					"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.aarch64",
					"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.aarch64"
				]
			},
			"remediations":[
				{
					"product_ids":[
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.src",
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.aarch64",
						"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.aarch64",
						"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.aarch64"
					],
					"details":"firefox security update",
					"category":"vendor_fix",
					"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1101"
				}
			],
			"scores":[
				{
					"cvss_v3":{
						"baseSeverity":"HIGH",
						"baseScore":8.8,
						"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
						"version":"3.1"
					},
					"products":[
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.src",
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.aarch64",
						"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.aarch64",
						"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.aarch64"
					]
				}
			],
			"threats":[
				{
					"details":"High",
					"category":"impact"
				}
			],
			"title":"CVE-2025-1010"
		},
		{
			"cve":"CVE-2025-1011",
			"notes":[
				{
					"text":"A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code execution. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.",
					"category":"description",
					"title":"Vulnerability Description"
				}
			],
			"product_status":{
				"fixed":[
					"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.src",
					"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.x86_64",
					"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.x86_64",
					"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.x86_64",
					"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.aarch64",
					"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.aarch64",
					"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.aarch64"
				]
			},
			"remediations":[
				{
					"product_ids":[
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.src",
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.aarch64",
						"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.aarch64",
						"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.aarch64"
					],
					"details":"firefox security update",
					"category":"vendor_fix",
					"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1101"
				}
			],
			"scores":[
				{
					"cvss_v3":{
						"baseSeverity":"HIGH",
						"baseScore":8.8,
						"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
						"version":"3.1"
					},
					"products":[
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.src",
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.aarch64",
						"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.aarch64",
						"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.aarch64"
					]
				}
			],
			"threats":[
				{
					"details":"High",
					"category":"impact"
				}
			],
			"title":"CVE-2025-1011"
		},
		{
			"cve":"CVE-2025-1012",
			"notes":[
				{
					"text":"A race during concurrent delazification could have led to a use-after-free. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.",
					"category":"description",
					"title":"Vulnerability Description"
				}
			],
			"product_status":{
				"fixed":[
					"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.src",
					"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.x86_64",
					"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.x86_64",
					"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.x86_64",
					"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.aarch64",
					"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.aarch64",
					"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.aarch64"
				]
			},
			"remediations":[
				{
					"product_ids":[
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.src",
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.aarch64",
						"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.aarch64",
						"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.aarch64"
					],
					"details":"firefox security update",
					"category":"vendor_fix",
					"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1101"
				}
			],
			"scores":[
				{
					"cvss_v3":{
						"baseSeverity":"HIGH",
						"baseScore":7.5,
						"vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
						"version":"3.1"
					},
					"products":[
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.src",
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.aarch64",
						"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.aarch64",
						"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.aarch64"
					]
				}
			],
			"threats":[
				{
					"details":"High",
					"category":"impact"
				}
			],
			"title":"CVE-2025-1012"
		},
		{
			"cve":"CVE-2025-1013",
			"notes":[
				{
					"text":"A race condition could have led to private browsing tabs being opened in normal browsing windows. This could have resulted in a potential privacy leak. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.",
					"category":"description",
					"title":"Vulnerability Description"
				}
			],
			"product_status":{
				"fixed":[
					"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.src",
					"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.x86_64",
					"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.x86_64",
					"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.x86_64",
					"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.aarch64",
					"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.aarch64",
					"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.aarch64"
				]
			},
			"remediations":[
				{
					"product_ids":[
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.src",
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.aarch64",
						"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.aarch64",
						"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.aarch64"
					],
					"details":"firefox security update",
					"category":"vendor_fix",
					"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1101"
				}
			],
			"scores":[
				{
					"cvss_v3":{
						"baseSeverity":"MEDIUM",
						"baseScore":6.5,
						"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
						"version":"3.1"
					},
					"products":[
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.src",
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.aarch64",
						"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.aarch64",
						"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.aarch64"
					]
				}
			],
			"threats":[
				{
					"details":"Medium",
					"category":"impact"
				}
			],
			"title":"CVE-2025-1013"
		},
		{
			"cve":"CVE-2025-1014",
			"notes":[
				{
					"text":"Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.",
					"category":"description",
					"title":"Vulnerability Description"
				}
			],
			"product_status":{
				"fixed":[
					"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.src",
					"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.x86_64",
					"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.x86_64",
					"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.x86_64",
					"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.aarch64",
					"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.aarch64",
					"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.aarch64"
				]
			},
			"remediations":[
				{
					"product_ids":[
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.src",
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.aarch64",
						"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.aarch64",
						"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.aarch64"
					],
					"details":"firefox security update",
					"category":"vendor_fix",
					"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1101"
				}
			],
			"scores":[
				{
					"cvss_v3":{
						"baseSeverity":"HIGH",
						"baseScore":8.8,
						"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
						"version":"3.1"
					},
					"products":[
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.src",
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.aarch64",
						"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.aarch64",
						"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.aarch64"
					]
				}
			],
			"threats":[
				{
					"details":"High",
					"category":"impact"
				}
			],
			"title":"CVE-2025-1014"
		},
		{
			"cve":"CVE-2025-1017",
			"notes":[
				{
					"text":"Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.",
					"category":"description",
					"title":"Vulnerability Description"
				}
			],
			"product_status":{
				"fixed":[
					"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.src",
					"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.x86_64",
					"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.x86_64",
					"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.x86_64",
					"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.aarch64",
					"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.aarch64",
					"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.aarch64"
				]
			},
			"remediations":[
				{
					"product_ids":[
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.src",
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.aarch64",
						"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.aarch64",
						"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.aarch64"
					],
					"details":"firefox security update",
					"category":"vendor_fix",
					"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1101"
				}
			],
			"scores":[
				{
					"cvss_v3":{
						"baseSeverity":"CRITICAL",
						"baseScore":9.8,
						"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
						"version":"3.1"
					},
					"products":[
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.src",
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.x86_64",
						"openEuler-24.03-LTS:firefox-128.7.0-1.oe2403.aarch64",
						"openEuler-24.03-LTS:firefox-debuginfo-128.7.0-1.oe2403.aarch64",
						"openEuler-24.03-LTS:firefox-debugsource-128.7.0-1.oe2403.aarch64"
					]
				}
			],
			"threats":[
				{
					"details":"Critical",
					"category":"impact"
				}
			],
			"title":"CVE-2025-1017"
		}
	]
}