An update for firefox is now available for openEuler-22.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2025-2593 Final 1.0 1.0 2025-10-31 Initial 2025-10-31 2025-10-31 openEuler SA Tool V1.0 2025-10-31 firefox security update An update for firefox is now available for openEuler-22.03-LTS-SP4 Security Fix(es): If temporary one-time permissions, such as the ability to use the Camera, were granted to a document loaded using a file: URL, that permission persisted in that tab for all other documents loaded from a file: URL. This is potentially dangerous if the local files came from different sources, such as in a download directory. This vulnerability affects Firefox < 111.(CVE-2023-28161) An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object s debugger vector. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.(CVE-2023-29543) Memory safety bugs present in Firefox 111. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.(CVE-2023-29551) Memory safety bugs present in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 142, Firefox ESR < 115.27, Firefox ESR < 128.14, Firefox ESR < 140.2, Thunderbird < 142, Thunderbird < 128.14, and Thunderbird < 140.2.(CVE-2025-9185) An update for firefox is now available for openEuler-22.03-LTS-SP4. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High firefox https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2593 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2023-28161 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2023-29543 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2023-29551 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2025-9185 https://nvd.nist.gov/vuln/detail/CVE-2023-28161 https://nvd.nist.gov/vuln/detail/CVE-2023-29543 https://nvd.nist.gov/vuln/detail/CVE-2023-29551 https://nvd.nist.gov/vuln/detail/CVE-2025-9185 openEuler-22.03-LTS-SP4 firefox-140.4.0-2.oe2203sp4.aarch64.rpm firefox-debuginfo-140.4.0-2.oe2203sp4.aarch64.rpm firefox-debugsource-140.4.0-2.oe2203sp4.aarch64.rpm firefox-140.4.0-2.oe2203sp4.src.rpm firefox-140.4.0-2.oe2203sp4.x86_64.rpm firefox-debuginfo-140.4.0-2.oe2203sp4.x86_64.rpm firefox-debugsource-140.4.0-2.oe2203sp4.x86_64.rpm If temporary one-time permissions, such as the ability to use the Camera, were granted to a document loaded using a file: URL, that permission persisted in that tab for all other documents loaded from a file: URL. This is potentially dangerous if the local files came from different sources, such as in a download directory. This vulnerability affects Firefox < 111. 2025-10-31 CVE-2023-28161 openEuler-22.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2025-10-31 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2593 An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object s debugger vector. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112. 2025-10-31 CVE-2023-29543 openEuler-22.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2025-10-31 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2593 Memory safety bugs present in Firefox 111. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112. 2025-10-31 CVE-2023-29551 openEuler-22.03-LTS-SP4 High 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H firefox security update 2025-10-31 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2593 Memory safety bugs present in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 142, Firefox ESR < 115.27, Firefox ESR < 128.14, Firefox ESR < 140.2, Thunderbird < 142, Thunderbird < 128.14, and Thunderbird < 140.2. 2025-10-31 CVE-2025-9185 openEuler-22.03-LTS-SP4 High 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H firefox security update 2025-10-31 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2593