An update for firefox is now available for openEuler-24.03-LTS Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2025-1101 Final 1.0 1.0 2025-02-08 Initial 2025-02-08 2025-02-08 openEuler SA Tool V1.0 2025-02-08 firefox security update An update for firefox is now available for openEuler-24.03-LTS Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. Security Fix(es): An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.(CVE-2025-1009) An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.(CVE-2025-1010) A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code execution. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.(CVE-2025-1011) A race during concurrent delazification could have led to a use-after-free. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.(CVE-2025-1012) A race condition could have led to private browsing tabs being opened in normal browsing windows. This could have resulted in a potential privacy leak. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.(CVE-2025-1013) Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.(CVE-2025-1014) Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.(CVE-2025-1017) An update for firefox is now available for master/openEuler-20.03-LTS-SP4/openEuler-22.03-LTS-SP3/openEuler-24.03-LTS/openEuler-24.03-LTS-Next/openEuler-22.03-LTS-SP4/openEuler-24.03-LTS-SP1. openEuler Security has rated this update as having a security impact of critical. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Critical firefox https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1101 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-1009 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-1010 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-1011 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-1012 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-1013 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-1014 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-1017 https://nvd.nist.gov/vuln/detail/CVE-2025-1009 https://nvd.nist.gov/vuln/detail/CVE-2025-1010 https://nvd.nist.gov/vuln/detail/CVE-2025-1011 https://nvd.nist.gov/vuln/detail/CVE-2025-1012 https://nvd.nist.gov/vuln/detail/CVE-2025-1013 https://nvd.nist.gov/vuln/detail/CVE-2025-1014 https://nvd.nist.gov/vuln/detail/CVE-2025-1017 openEuler-24.03-LTS firefox-128.7.0-1.oe2403.src.rpm firefox-128.7.0-1.oe2403.x86_64.rpm firefox-debuginfo-128.7.0-1.oe2403.x86_64.rpm firefox-debugsource-128.7.0-1.oe2403.x86_64.rpm firefox-128.7.0-1.oe2403.aarch64.rpm firefox-debuginfo-128.7.0-1.oe2403.aarch64.rpm firefox-debugsource-128.7.0-1.oe2403.aarch64.rpm An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135. 2025-02-08 CVE-2025-1009 openEuler-24.03-LTS Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H firefox security update 2025-02-08 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1101 An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135. 2025-02-08 CVE-2025-1010 openEuler-24.03-LTS High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2025-02-08 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1101 A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code execution. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135. 2025-02-08 CVE-2025-1011 openEuler-24.03-LTS High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2025-02-08 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1101 A race during concurrent delazification could have led to a use-after-free. This vulnerability affects Firefox < 135, Firefox ESR < 115.20, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135. 2025-02-08 CVE-2025-1012 openEuler-24.03-LTS High 7.5 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2025-02-08 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1101 A race condition could have led to private browsing tabs being opened in normal browsing windows. This could have resulted in a potential privacy leak. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135. 2025-02-08 CVE-2025-1013 openEuler-24.03-LTS Medium 6.5 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N firefox security update 2025-02-08 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1101 Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135. 2025-02-08 CVE-2025-1014 openEuler-24.03-LTS High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2025-02-08 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1101 Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135. 2025-02-08 CVE-2025-1017 openEuler-24.03-LTS Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H firefox security update 2025-02-08 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1101