An update for firefox is now available for openEuler-22.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2025-1323 Final 1.0 1.0 2025-03-21 Initial 2025-03-21 2025-03-21 openEuler SA Tool V1.0 2025-03-21 firefox security update An update for firefox is now available for openEuler-22.03-LTS-SP4 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global moz_debug_prefix /lib/debug %global moz_debug_dir /lib/debug/ %global uname_m %(uname -m) %global symbols_file_name -.en-US.-%(uname.crashreporter-symbols.zip %global symbols_file_path /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip %global _find_debuginfo_opts -p /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip -o debugcrashreporter.list %global crashreporter_pkg_name mozilla-crashreporter--debuginfo Security Fix(es): Multiple NSS NIST curves were susceptible to a side-channel attack known as "Minerva". This attack could potentially allow an attacker to recover the private key. This vulnerability affects Firefox < 121.(CVE-2023-6135) Ownership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5.(CVE-2023-6207) When using X11, text selected by the page using the Selection API was erroneously copied into the primary selection, a temporary storage not unlike the clipboard. *This bug only affects Firefox on X11. Other systems are unaffected.* This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5.(CVE-2023-6208) Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in the path could be used to override the specified host. This could contribute to security problems in web sites. This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5.(CVE-2023-6209) When an https: web page created a pop-up from a "javascript:" URL, that pop-up was incorrectly allowed to load blockable content such as iframes from insecure http: URLs This vulnerability affects Firefox < 120.(CVE-2023-6210) If an attacker needed a user to load an insecure http: page and knew that user had enabled HTTPS-only mode, the attacker could have tricked the user into clicking to grant an HTTPS-only exception if they could get the user to participate in a clicking game. This vulnerability affects Firefox < 120.(CVE-2023-6211) Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5.(CVE-2023-6212) Memory safety bugs present in Firefox 119. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 120.(CVE-2023-6213) The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow an attacker to perform remote code execution and sandbox escape. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.(CVE-2023-6856) When resolving a symlink, a race may occur where the buffer passed to `readlink` may actually be smaller than necessary. *This bug only affects Firefox on Unix-based operating systems (Android, Linux, MacOS). Windows is unaffected.* This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.(CVE-2023-6857) Firefox was susceptible to a heap buffer overflow in `nsTextFragment` due to insufficient OOM handling. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.(CVE-2023-6858) The `nsWindow::PickerOpen(void)` method was susceptible to a heap buffer overflow when running in headless mode. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.(CVE-2023-6861) A use-after-free was identified in the `nsDNSService::Init`. This issue appears to manifest rarely during start-up. This vulnerability affects Firefox ESR < 115.6 and Thunderbird < 115.6.(CVE-2023-6862) Memory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.(CVE-2023-6864) `EncryptingOutputStream` was susceptible to exposing uninitialized data. This issue could only be abused in order to write data to a local disk which may have implications for private browsing mode. This vulnerability affects Firefox ESR < 115.6 and Firefox < 121.(CVE-2023-6865) The timing of a button click causing a popup to disappear was approximately the same length as the anti-clickjacking delay on permission prompts. It was possible to use this fact to surprise users by luring them to click where the permission grant button would be about to appear. This vulnerability affects Firefox ESR < 115.6 and Firefox < 121.(CVE-2023-6867) Under certain conditions, Firefox did not display a warning when a user attempted to navigate to a new protocol handler. This vulnerability affects Firefox < 121.(CVE-2023-6871) Browser tab titles were being leaked by GNOME to system logs. This could potentially expose the browsing habits of users running in a private tab. This vulnerability affects Firefox < 121.(CVE-2023-6872) Memory safety bugs present in Firefox 120. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 121.(CVE-2023-6873) An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable crash. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7.(CVE-2024-0741) It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an incorrect timestamp used to prevent input after page load. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7.(CVE-2024-0742) In some circumstances, JIT compiled code could have dereferenced a wild pointer value. This could have led to an exploitable crash. This vulnerability affects Firefox < 122.(CVE-2024-0744) When a parent page loaded a child in an iframe with `unsafe-inline`, the parent Content Security Policy could have overridden the child Content Security Policy. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7.(CVE-2024-0747) A phishing site could have repurposed an `about:` dialog to show phishing content with an incorrect origin in the address bar. This vulnerability affects Firefox < 122 and Thunderbird < 115.7.(CVE-2024-0749) A malicious devtools extension could have been used to escalate privileges. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7.(CVE-2024-0751) In specific HSTS configurations an attacker could have bypassed HSTS on a subdomain. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7.(CVE-2024-0753) Memory safety bugs present in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7.(CVE-2024-0755) On Windows 10, when using the 'Save As' functionality, an attacker could have tricked the browser into saving the file with a disallowed extension such as `.url` by including an invalid character in the extension. *Note:* This issue only affected Windows operating systems. Other operating systems are unaffected. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12.(CVE-2024-5692) An attacker could have caused a use-after-free in the JavaScript engine to read memory in the JavaScript string section of the heap. This vulnerability affects Firefox < 127.(CVE-2024-5694) If an out-of-memory condition occurs at a specific point using allocations in the probabilistic heap checker, an assertion could have been triggered, and in rarer situations, memory corruption could have occurred. This vulnerability affects Firefox < 127.(CVE-2024-5695) By manipulating the fullscreen feature while opening a data-list, an attacker could have overlaid a text box over the address bar. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 127.(CVE-2024-5698) In violation of spec, cookie prefixes such as `__Secure` were being ignored if they were not correctly capitalized - by spec they should be checked with a case-insensitive comparison. This could have resulted in the browser not correctly honoring the behaviors specified by the prefix. This vulnerability affects Firefox < 127.(CVE-2024-5699) Memory safety bugs present in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12.(CVE-2024-5700) Memory safety bugs present in Firefox 126. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 127.(CVE-2024-5701) Memory corruption in the networking stack could have led to a potentially exploitable crash. This vulnerability affects Firefox < 125, Firefox ESR < 115.12, and Thunderbird < 115.12.(CVE-2024-5702) If a site had been granted the permission to open popup windows, it could cause Select elements to appear on top of another site to perform a spoofing attack. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and Thunderbird < 128.2.(CVE-2024-8386) An update for firefox is now available for openEuler-20.03-LTS-SP4/openEuler-22.03-LTS-SP4. openEuler Security has rated this update as having a security impact of critical. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Critical firefox https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2023-6135 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2023-6207 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2023-6208 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2023-6209 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2023-6210 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2023-6211 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2023-6212 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2023-6213 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2023-6856 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2023-6857 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2023-6858 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2023-6861 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2023-6862 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2023-6864 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2023-6865 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2023-6867 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2023-6871 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2023-6872 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2023-6873 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-0741 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-0742 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-0744 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-0747 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-0749 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-0751 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-0753 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-0755 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-5692 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-5694 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-5695 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-5698 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-5699 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-5700 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-5701 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-5702 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-8386 https://nvd.nist.gov/vuln/detail/CVE-2023-6135 https://nvd.nist.gov/vuln/detail/CVE-2023-6207 https://nvd.nist.gov/vuln/detail/CVE-2023-6208 https://nvd.nist.gov/vuln/detail/CVE-2023-6209 https://nvd.nist.gov/vuln/detail/CVE-2023-6210 https://nvd.nist.gov/vuln/detail/CVE-2023-6211 https://nvd.nist.gov/vuln/detail/CVE-2023-6212 https://nvd.nist.gov/vuln/detail/CVE-2023-6213 https://nvd.nist.gov/vuln/detail/CVE-2023-6856 https://nvd.nist.gov/vuln/detail/CVE-2023-6857 https://nvd.nist.gov/vuln/detail/CVE-2023-6858 https://nvd.nist.gov/vuln/detail/CVE-2023-6861 https://nvd.nist.gov/vuln/detail/CVE-2023-6862 https://nvd.nist.gov/vuln/detail/CVE-2023-6864 https://nvd.nist.gov/vuln/detail/CVE-2023-6865 https://nvd.nist.gov/vuln/detail/CVE-2023-6867 https://nvd.nist.gov/vuln/detail/CVE-2023-6871 https://nvd.nist.gov/vuln/detail/CVE-2023-6872 https://nvd.nist.gov/vuln/detail/CVE-2023-6873 https://nvd.nist.gov/vuln/detail/CVE-2024-0741 https://nvd.nist.gov/vuln/detail/CVE-2024-0742 https://nvd.nist.gov/vuln/detail/CVE-2024-0744 https://nvd.nist.gov/vuln/detail/CVE-2024-0747 https://nvd.nist.gov/vuln/detail/CVE-2024-0749 https://nvd.nist.gov/vuln/detail/CVE-2024-0751 https://nvd.nist.gov/vuln/detail/CVE-2024-0753 https://nvd.nist.gov/vuln/detail/CVE-2024-0755 https://nvd.nist.gov/vuln/detail/CVE-2024-5692 https://nvd.nist.gov/vuln/detail/CVE-2024-5694 https://nvd.nist.gov/vuln/detail/CVE-2024-5695 https://nvd.nist.gov/vuln/detail/CVE-2024-5698 https://nvd.nist.gov/vuln/detail/CVE-2024-5699 https://nvd.nist.gov/vuln/detail/CVE-2024-5700 https://nvd.nist.gov/vuln/detail/CVE-2024-5701 https://nvd.nist.gov/vuln/detail/CVE-2024-5702 https://nvd.nist.gov/vuln/detail/CVE-2024-8386 openEuler-22.03-LTS-SP4 firefox-128.8.0-1.oe2203sp4.aarch64.rpm firefox-debuginfo-128.8.0-1.oe2203sp4.aarch64.rpm firefox-debugsource-128.8.0-1.oe2203sp4.aarch64.rpm firefox-128.8.0-1.oe2203sp4.src.rpm firefox-128.8.0-1.oe2203sp4.x86_64.rpm firefox-debuginfo-128.8.0-1.oe2203sp4.x86_64.rpm firefox-debugsource-128.8.0-1.oe2203sp4.x86_64.rpm Multiple NSS NIST curves were susceptible to a side-channel attack known as "Minerva". This attack could potentially allow an attacker to recover the private key. This vulnerability affects Firefox < 121. 2025-03-21 CVE-2023-6135 openEuler-22.03-LTS-SP4 Medium 4.3 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N firefox security update 2025-03-21 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323 Ownership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5. 2025-03-21 CVE-2023-6207 openEuler-22.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2025-03-21 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323 When using X11, text selected by the page using the Selection API was erroneously copied into the primary selection, a temporary storage not unlike the clipboard. *This bug only affects Firefox on X11. Other systems are unaffected.* This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5. 2025-03-21 CVE-2023-6208 openEuler-22.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2025-03-21 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323 Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in the path could be used to override the specified host. This could contribute to security problems in web sites. This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5. 2025-03-21 CVE-2023-6209 openEuler-22.03-LTS-SP4 Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N firefox security update 2025-03-21 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323 When an https: web page created a pop-up from a "javascript:" URL, that pop-up was incorrectly allowed to load blockable content such as iframes from insecure http: URLs This vulnerability affects Firefox < 120. 2025-03-21 CVE-2023-6210 openEuler-22.03-LTS-SP4 Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N firefox security update 2025-03-21 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323 If an attacker needed a user to load an insecure http: page and knew that user had enabled HTTPS-only mode, the attacker could have tricked the user into clicking to grant an HTTPS-only exception if they could get the user to participate in a clicking game. This vulnerability affects Firefox < 120. 2025-03-21 CVE-2023-6211 openEuler-22.03-LTS-SP4 Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N firefox security update 2025-03-21 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323 Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5. 2025-03-21 CVE-2023-6212 openEuler-22.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2025-03-21 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323 Memory safety bugs present in Firefox 119. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 120. 2025-03-21 CVE-2023-6213 openEuler-22.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2025-03-21 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323 The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow an attacker to perform remote code execution and sandbox escape. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. 2025-03-21 CVE-2023-6856 openEuler-22.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2025-03-21 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323 When resolving a symlink, a race may occur where the buffer passed to `readlink` may actually be smaller than necessary. *This bug only affects Firefox on Unix-based operating systems (Android, Linux, MacOS). Windows is unaffected.* This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. 2025-03-21 CVE-2023-6857 openEuler-22.03-LTS-SP4 Medium 5.3 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N firefox security update 2025-03-21 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323 Firefox was susceptible to a heap buffer overflow in `nsTextFragment` due to insufficient OOM handling. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. 2025-03-21 CVE-2023-6858 openEuler-22.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2025-03-21 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323 The `nsWindow::PickerOpen(void)` method was susceptible to a heap buffer overflow when running in headless mode. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. 2025-03-21 CVE-2023-6861 openEuler-22.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2025-03-21 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323 A use-after-free was identified in the `nsDNSService::Init`. This issue appears to manifest rarely during start-up. This vulnerability affects Firefox ESR < 115.6 and Thunderbird < 115.6. 2025-03-21 CVE-2023-6862 openEuler-22.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2025-03-21 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323 Memory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. 2025-03-21 CVE-2023-6864 openEuler-22.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2025-03-21 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323 `EncryptingOutputStream` was susceptible to exposing uninitialized data. This issue could only be abused in order to write data to a local disk which may have implications for private browsing mode. This vulnerability affects Firefox ESR < 115.6 and Firefox < 121. 2025-03-21 CVE-2023-6865 openEuler-22.03-LTS-SP4 Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N firefox security update 2025-03-21 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323 The timing of a button click causing a popup to disappear was approximately the same length as the anti-clickjacking delay on permission prompts. It was possible to use this fact to surprise users by luring them to click where the permission grant button would be about to appear. This vulnerability affects Firefox ESR < 115.6 and Firefox < 121. 2025-03-21 CVE-2023-6867 openEuler-22.03-LTS-SP4 Medium 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N firefox security update 2025-03-21 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323 Under certain conditions, Firefox did not display a warning when a user attempted to navigate to a new protocol handler. This vulnerability affects Firefox < 121. 2025-03-21 CVE-2023-6871 openEuler-22.03-LTS-SP4 Medium 4.3 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N firefox security update 2025-03-21 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323 Browser tab titles were being leaked by GNOME to system logs. This could potentially expose the browsing habits of users running in a private tab. This vulnerability affects Firefox < 121. 2025-03-21 CVE-2023-6872 openEuler-22.03-LTS-SP4 Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N firefox security update 2025-03-21 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323 Memory safety bugs present in Firefox 120. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 121. 2025-03-21 CVE-2023-6873 openEuler-22.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2025-03-21 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323 An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable crash. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7. 2025-03-21 CVE-2024-0741 openEuler-22.03-LTS-SP4 Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H firefox security update 2025-03-21 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323 It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an incorrect timestamp used to prevent input after page load. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7. 2025-03-21 CVE-2024-0742 openEuler-22.03-LTS-SP4 Medium 4.3 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N firefox security update 2025-03-21 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323 In some circumstances, JIT compiled code could have dereferenced a wild pointer value. This could have led to an exploitable crash. This vulnerability affects Firefox < 122. 2025-03-21 CVE-2024-0744 openEuler-22.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H firefox security update 2025-03-21 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323 When a parent page loaded a child in an iframe with `unsafe-inline`, the parent Content Security Policy could have overridden the child Content Security Policy. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7. 2025-03-21 CVE-2024-0747 openEuler-22.03-LTS-SP4 Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N firefox security update 2025-03-21 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323 A phishing site could have repurposed an `about:` dialog to show phishing content with an incorrect origin in the address bar. This vulnerability affects Firefox < 122 and Thunderbird < 115.7. 2025-03-21 CVE-2024-0749 openEuler-22.03-LTS-SP4 Medium 4.3 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N firefox security update 2025-03-21 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323 A malicious devtools extension could have been used to escalate privileges. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7. 2025-03-21 CVE-2024-0751 openEuler-22.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2025-03-21 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323 In specific HSTS configurations an attacker could have bypassed HSTS on a subdomain. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7. 2025-03-21 CVE-2024-0753 openEuler-22.03-LTS-SP4 Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N firefox security update 2025-03-21 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323 Memory safety bugs present in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7. 2025-03-21 CVE-2024-0755 openEuler-22.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2025-03-21 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323 On Windows 10, when using the 'Save As' functionality, an attacker could have tricked the browser into saving the file with a disallowed extension such as `.url` by including an invalid character in the extension. *Note:* This issue only affected Windows operating systems. Other operating systems are unaffected. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12. 2025-03-21 CVE-2024-5692 openEuler-22.03-LTS-SP4 Medium 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N firefox security update 2025-03-21 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323 An attacker could have caused a use-after-free in the JavaScript engine to read memory in the JavaScript string section of the heap. This vulnerability affects Firefox < 127. 2025-03-21 CVE-2024-5694 openEuler-22.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N firefox security update 2025-03-21 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323 If an out-of-memory condition occurs at a specific point using allocations in the probabilistic heap checker, an assertion could have been triggered, and in rarer situations, memory corruption could have occurred. This vulnerability affects Firefox < 127. 2025-03-21 CVE-2024-5695 openEuler-22.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H firefox security update 2025-03-21 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323 By manipulating the fullscreen feature while opening a data-list, an attacker could have overlaid a text box over the address bar. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 127. 2025-03-21 CVE-2024-5698 openEuler-22.03-LTS-SP4 Medium 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N firefox security update 2025-03-21 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323 In violation of spec, cookie prefixes such as `__Secure` were being ignored if they were not correctly capitalized - by spec they should be checked with a case-insensitive comparison. This could have resulted in the browser not correctly honoring the behaviors specified by the prefix. This vulnerability affects Firefox < 127. 2025-03-21 CVE-2024-5699 openEuler-22.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H firefox security update 2025-03-21 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323 Memory safety bugs present in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12. 2025-03-21 CVE-2024-5700 openEuler-22.03-LTS-SP4 High 7.0 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2025-03-21 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323 Memory safety bugs present in Firefox 126. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 127. 2025-03-21 CVE-2024-5701 openEuler-22.03-LTS-SP4 Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H firefox security update 2025-03-21 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323 Memory corruption in the networking stack could have led to a potentially exploitable crash. This vulnerability affects Firefox < 125, Firefox ESR < 115.12, and Thunderbird < 115.12. 2025-03-21 CVE-2024-5702 openEuler-22.03-LTS-SP4 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H firefox security update 2025-03-21 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323 If a site had been granted the permission to open popup windows, it could cause Select elements to appear on top of another site to perform a spoofing attack. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and Thunderbird < 128.2. 2025-03-21 CVE-2024-8386 openEuler-22.03-LTS-SP4 Medium 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N firefox security update 2025-03-21 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1323