An update for firefox is now available for openEuler-22.03-LTS-SP3 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2025-1634 Final 1.0 1.0 2025-06-13 Initial 2025-06-13 2025-06-13 openEuler SA Tool V1.0 2025-06-13 firefox security update An update for firefox is now available for openEuler-22.03-LTS-SP3 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. Security Fix(es): Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin leak attacks. This vulnerability affects Firefox < 139, Firefox ESR < 115.24, Firefox ESR < 128.11, Thunderbird < 139, and Thunderbird < 128.11.(CVE-2025-5263) Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. This vulnerability affects Firefox < 139, Firefox ESR < 115.24, Firefox ESR < 128.11, Thunderbird < 139, and Thunderbird < 128.11.(CVE-2025-5264) Script elements loading cross-origin resources generated load and error events which leaked information enabling XS-Leaks attacks. This vulnerability affects Firefox < 139, Firefox ESR < 128.11, Thunderbird < 139, and Thunderbird < 128.11.(CVE-2025-5266) A clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious page. This vulnerability affects Firefox < 139, Firefox ESR < 128.11, Thunderbird < 139, and Thunderbird < 128.11.(CVE-2025-5267) Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 139, Firefox ESR < 128.11, Thunderbird < 139, and Thunderbird < 128.11.(CVE-2025-5268) Memory safety bug present in Firefox ESR 128.10, and Thunderbird 128.10. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 128.11 and Thunderbird < 128.11.(CVE-2025-5269) An update for firefox is now available for master/openEuler-20.03-LTS-SP4/openEuler-22.03-LTS-SP3/openEuler-22.03-LTS-SP4/openEuler-24.03-LTS/openEuler-24.03-LTS-Next/openEuler-24.03-LTS-SP1/openEuler-24.03-LTS-SP2. openEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Medium firefox https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1634 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-5263 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-5264 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-5266 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-5267 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-5268 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-5269 https://nvd.nist.gov/vuln/detail/CVE-2025-5263 https://nvd.nist.gov/vuln/detail/CVE-2025-5264 https://nvd.nist.gov/vuln/detail/CVE-2025-5266 https://nvd.nist.gov/vuln/detail/CVE-2025-5267 https://nvd.nist.gov/vuln/detail/CVE-2025-5268 https://nvd.nist.gov/vuln/detail/CVE-2025-5269 openEuler-22.03-LTS-SP3 firefox-128.11.0-1.oe2203sp3.x86_64.rpm firefox-debuginfo-128.11.0-1.oe2203sp3.x86_64.rpm firefox-debugsource-128.11.0-1.oe2203sp3.x86_64.rpm firefox-128.11.0-1.oe2203sp3.aarch64.rpm firefox-debuginfo-128.11.0-1.oe2203sp3.aarch64.rpm firefox-debugsource-128.11.0-1.oe2203sp3.aarch64.rpm firefox-128.11.0-1.oe2203sp3.src.rpm Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin leak attacks. This vulnerability affects Firefox < 139, Firefox ESR < 115.24, Firefox ESR < 128.11, Thunderbird < 139, and Thunderbird < 128.11. 2025-06-13 CVE-2025-5263 openEuler-22.03-LTS-SP3 Medium 4.3 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N firefox security update 2025-06-13 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1634 Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. This vulnerability affects Firefox < 139, Firefox ESR < 115.24, Firefox ESR < 128.11, Thunderbird < 139, and Thunderbird < 128.11. 2025-06-13 CVE-2025-5264 openEuler-22.03-LTS-SP3 Medium 4.8 AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L firefox security update 2025-06-13 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1634 Script elements loading cross-origin resources generated load and error events which leaked information enabling XS-Leaks attacks. This vulnerability affects Firefox < 139, Firefox ESR < 128.11, Thunderbird < 139, and Thunderbird < 128.11. 2025-06-13 CVE-2025-5266 openEuler-22.03-LTS-SP3 Medium 6.5 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N firefox security update 2025-06-13 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1634 A clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious page. This vulnerability affects Firefox < 139, Firefox ESR < 128.11, Thunderbird < 139, and Thunderbird < 128.11. 2025-06-13 CVE-2025-5267 openEuler-22.03-LTS-SP3 Medium 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N firefox security update 2025-06-13 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1634 Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 139, Firefox ESR < 128.11, Thunderbird < 139, and Thunderbird < 128.11. 2025-06-13 CVE-2025-5268 openEuler-22.03-LTS-SP3 Medium 6.5 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N firefox security update 2025-06-13 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1634 Memory safety bug present in Firefox ESR 128.10, and Thunderbird 128.10. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 128.11 and Thunderbird < 128.11. 2025-06-13 CVE-2025-5269 openEuler-22.03-LTS-SP3 Medium 6.5 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N firefox security update 2025-06-13 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1634