Action not permitted
Modal body text goes here.
Modal Title
Modal Body
ALSA-2025:8756
Vulnerability from osv_almalinux – Published: 2025-06-10 00:00 – Updated: 2025-06-10 14:57 – Source website
VLAI
Summary
Important: thunderbird security update
Details
Mozilla Thunderbird is a standalone mail and newsgroup client.
Security Fix(es):
- thunderbird: JavaScript Execution via Spoofed PDF Attachment and file:/// Link (CVE-2025-3909)
- thunderbird: Sender Spoofing via Malformed From Header in Thunderbird (CVE-2025-3875)
- thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links (CVE-2025-3877)
- thunderbird: Tracking Links in Attachments Bypassed Remote Content Blocking (CVE-2025-3932)
- firefox: thunderbird: Out-of-bounds access when resolving Promise objects (CVE-2025-4918)
- firefox: thunderbird: Out-of-bounds access when optimizing linear sums (CVE-2025-4919)
- firefox: thunderbird: Clickjacking vulnerability could have led to leaking saved payment card details (CVE-2025-5267)
- firefox: thunderbird: Potential local code execution in ?Copy as cURL? command (CVE-2025-5264)
- firefox: thunderbird: Memory safety bugs (CVE-2025-5268)
- firefox: thunderbird: Script element events leaked cross-origin resource status (CVE-2025-5266)
- firefox: thunderbird: Error handling for script execution was incorrectly isolated from web content (CVE-2025-5263)
- firefox: thunderbird: Memory safety bug (CVE-2025-5269)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "thunderbird"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "128.11.0-1.el8_10.alma.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "Mozilla Thunderbird is a standalone mail and newsgroup client. \n\nSecurity Fix(es): \n\n * thunderbird: JavaScript Execution via Spoofed PDF Attachment and file:/// Link (CVE-2025-3909)\n * thunderbird: Sender Spoofing via Malformed From Header in Thunderbird (CVE-2025-3875)\n * thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links (CVE-2025-3877)\n * thunderbird: Tracking Links in Attachments Bypassed Remote Content Blocking (CVE-2025-3932)\n * firefox: thunderbird: Out-of-bounds access when resolving Promise objects (CVE-2025-4918)\n * firefox: thunderbird: Out-of-bounds access when optimizing linear sums (CVE-2025-4919)\n * firefox: thunderbird: Clickjacking vulnerability could have led to leaking saved payment card details (CVE-2025-5267)\n * firefox: thunderbird: Potential local code execution in ?Copy as cURL? command (CVE-2025-5264)\n * firefox: thunderbird: Memory safety bugs (CVE-2025-5268)\n * firefox: thunderbird: Script element events leaked cross-origin resource status (CVE-2025-5266)\n * firefox: thunderbird: Error handling for script execution was incorrectly isolated from web content (CVE-2025-5263)\n * firefox: thunderbird: Memory safety bug (CVE-2025-5269)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
"id": "ALSA-2025:8756",
"modified": "2025-06-10T14:57:05Z",
"published": "2025-06-10T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2025:8756"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-3875"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-3877"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-3909"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-3932"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-4918"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-4919"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-5263"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-5264"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-5266"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-5267"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-5268"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2025-5269"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2366283"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2366287"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2366291"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2366297"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2367016"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2367018"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2368750"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2368751"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2368752"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2368755"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2368756"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2368757"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/8/ALSA-2025-8756.html"
}
],
"related": [
"CVE-2025-3909",
"CVE-2025-3875",
"CVE-2025-3877",
"CVE-2025-3932",
"CVE-2025-4918",
"CVE-2025-4919",
"CVE-2025-5267",
"CVE-2025-5264",
"CVE-2025-5268",
"CVE-2025-5266",
"CVE-2025-5263",
"CVE-2025-5269"
],
"summary": "Important: thunderbird security update"
}
CVE-2025-3875 (GCVE-0-2025-3875)
Vulnerability from cvelistv5 – Published: 2025-05-14 16:56 – Updated: 2026-04-13 14:27
VLAI
EPSS
VEX
Title
Sender Spoofing via Malformed From Header in Thunderbird
Summary
Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header contains an (invalid) value "Spoofed Name ", Thunderbird treats spoofed@example.com as the actual address. This vulnerability was fixed in Thunderbird 128.10.1 and Thunderbird 138.0.1.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-05-15 14:52 UTC
CWE
- CWE-290 - Authentication Bypass by Spoofing
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Thunderbird |
Unaffected:
128.10.1 , ≤ 128.*
(rpm)
Unaffected: 138.0.1 , ≤ * (rpm) |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-3875",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-15T14:52:16.337372Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290 Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-15T14:52:49.671Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T19:58:36.011Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00022.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "128.*",
"status": "unaffected",
"version": "128.10.1",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "138.0.1",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "xh4vm"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header contains an (invalid) value \"Spoofed Name \u003cspoofed@example.com\u003e \u003clegitimate@example.com\u003e\", Thunderbird treats spoofed@example.com as the actual address. This vulnerability was fixed in Thunderbird 128.10.1 and Thunderbird 138.0.1."
}
],
"value": "Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header contains an (invalid) value \"Spoofed Name \", Thunderbird treats spoofed@example.com as the actual address. This vulnerability was fixed in Thunderbird 128.10.1 and Thunderbird 138.0.1."
}
],
"providerMetadata": {
"dateUpdated": "2026-04-13T14:27:50.877Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1950629"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-34/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-35/"
}
],
"title": "Sender Spoofing via Malformed From Header in Thunderbird"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2025-3875",
"datePublished": "2025-05-14T16:56:42.950Z",
"dateReserved": "2025-04-22T16:38:29.461Z",
"dateUpdated": "2026-04-13T14:27:50.877Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-3877 (GCVE-0-2025-3877)
Vulnerability from cvelistv5 – Published: 2025-05-14 16:56 – Updated: 2025-06-11 12:10
VLAI
EPSS
VEX
This CVE was marked as fixed, but due to other code landing - was not actually fixed. It was subsequently fixed in CVE-2025-5986.
Show details on NVD website{
"containers": {
"cna": {
"providerMetadata": {
"dateUpdated": "2025-06-11T12:10:53.177Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"rejectedReasons": [
{
"lang": "en",
"value": "This CVE was marked as fixed, but due to other code landing - was not actually fixed. It was subsequently fixed in CVE-2025-5986."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2025-3877",
"datePublished": "2025-05-14T16:56:43.402Z",
"dateRejected": "2025-06-11T12:10:53.177Z",
"dateReserved": "2025-04-22T17:02:56.161Z",
"dateUpdated": "2025-06-11T12:10:53.177Z",
"state": "REJECTED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-3909 (GCVE-0-2025-3909)
Vulnerability from cvelistv5 – Published: 2025-05-14 16:56 – Updated: 2026-04-13 14:27
VLAI
EPSS
VEX
Title
JavaScript Execution via Spoofed PDF Attachment and file:/// Link
Summary
Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context. By crafting a nested email attachment (message/rfc822) and setting its content type to application/pdf, Thunderbird may incorrectly render it as HTML when opened, allowing the embedded JavaScript to run without requiring a file download. This behavior relies on Thunderbird auto-saving the attachment to /tmp and linking to it via the file:/// protocol, potentially enabling JavaScript execution as part of the HTML. This vulnerability was fixed in Thunderbird 128.10.1 and Thunderbird 138.0.1.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-05-16 03:55 UTC
CWE
- CWE-356 - Product UI does not Warn User of Unsafe Actions
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Thunderbird |
Unaffected:
128.10.1 , ≤ 128.*
(rpm)
Unaffected: 138.0.1 , ≤ * (rpm) |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-3909",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-16T03:55:44.016748Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-356",
"description": "CWE-356 Product UI does not Warn User of Unsafe Actions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T18:28:09.659Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T19:58:39.208Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00022.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "128.*",
"status": "unaffected",
"version": "128.10.1",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "138.0.1",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Dario Wei\u00dfer"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Thunderbird\u0027s handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context. By crafting a nested email attachment (message/rfc822) and setting its content type to application/pdf, Thunderbird may incorrectly render it as HTML when opened, allowing the embedded JavaScript to run without requiring a file download. This behavior relies on Thunderbird auto-saving the attachment to /tmp and linking to it via the file:/// protocol, potentially enabling JavaScript execution as part of the HTML. This vulnerability was fixed in Thunderbird 128.10.1 and Thunderbird 138.0.1."
}
],
"value": "Thunderbird\u0027s handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context. By crafting a nested email attachment (message/rfc822) and setting its content type to application/pdf, Thunderbird may incorrectly render it as HTML when opened, allowing the embedded JavaScript to run without requiring a file download. This behavior relies on Thunderbird auto-saving the attachment to /tmp and linking to it via the file:/// protocol, potentially enabling JavaScript execution as part of the HTML. This vulnerability was fixed in Thunderbird 128.10.1 and Thunderbird 138.0.1."
}
],
"providerMetadata": {
"dateUpdated": "2026-04-13T14:27:53.020Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1958376"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-34/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-35/"
}
],
"title": "JavaScript Execution via Spoofed PDF Attachment and file:/// Link"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2025-3909",
"datePublished": "2025-05-14T16:56:43.630Z",
"dateReserved": "2025-04-23T17:44:42.650Z",
"dateUpdated": "2026-04-13T14:27:53.020Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-3932 (GCVE-0-2025-3932)
Vulnerability from cvelistv5 – Published: 2025-05-14 16:56 – Updated: 2026-04-13 14:27
VLAI
EPSS
VEX
Title
Tracking Links in Attachments Bypassed Remote Content Blocking
Summary
It was possible to craft an email that showed a tracking link as an attachment. If the user attempted to open the attachment, Thunderbird automatically accessed the link. The configuration to block remote content did not prevent that. Thunderbird has been fixed to no longer allow access to web pages listed in the X-Mozilla-External-Attachment-URL header of an email. This vulnerability was fixed in Thunderbird 128.10.1 and Thunderbird 138.0.1.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-05-15 14:40 UTC
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Thunderbird |
Unaffected:
128.10.1 , ≤ 128.*
(rpm)
Unaffected: 138.0.1 , ≤ * (rpm) |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-3932",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-15T14:40:19.087115Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-15T15:53:33.418Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T19:58:40.582Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00022.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "128.*",
"status": "unaffected",
"version": "128.10.1",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "138.0.1",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Dario Wei\u00dfer"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "It was possible to craft an email that showed a tracking link as an attachment. If the user attempted to open the attachment, Thunderbird automatically accessed the link. The configuration to block remote content did not prevent that. Thunderbird has been fixed to no longer allow access to web pages listed in the X-Mozilla-External-Attachment-URL header of an email. This vulnerability was fixed in Thunderbird 128.10.1 and Thunderbird 138.0.1."
}
],
"value": "It was possible to craft an email that showed a tracking link as an attachment. If the user attempted to open the attachment, Thunderbird automatically accessed the link. The configuration to block remote content did not prevent that. Thunderbird has been fixed to no longer allow access to web pages listed in the X-Mozilla-External-Attachment-URL header of an email. This vulnerability was fixed in Thunderbird 128.10.1 and Thunderbird 138.0.1."
}
],
"providerMetadata": {
"dateUpdated": "2026-04-13T14:27:54.782Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1960412"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-34/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-35/"
}
],
"title": "Tracking Links in Attachments Bypassed Remote Content Blocking"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2025-3932",
"datePublished": "2025-05-14T16:56:43.939Z",
"dateReserved": "2025-04-25T12:43:02.149Z",
"dateUpdated": "2026-04-13T14:27:54.782Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-4918 (GCVE-0-2025-4918)
Vulnerability from cvelistv5 – Published: 2025-05-17 21:07 – Updated: 2026-04-13 14:25
VLAI
EPSS
VEX
Title
Out-of-bounds access when resolving Promise objects
Summary
An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object. This vulnerability was fixed in Firefox 138.0.4, Firefox ESR 128.10.1, Firefox ESR 115.23.1, Thunderbird 128.10.2, and Thunderbird 138.0.2.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-05-20 03:55 UTC
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=1966612 | |
| https://www.mozilla.org/security/advisories/mfsa2… | |
| https://www.mozilla.org/security/advisories/mfsa2… | |
| https://www.mozilla.org/security/advisories/mfsa2… | |
| https://www.mozilla.org/security/advisories/mfsa2… | |
| https://www.mozilla.org/security/advisories/mfsa2… | |
| https://www.vicarius.io/vsociety/posts/cve-2025-4… | |
| https://www.vicarius.io/vsociety/posts/cve-2025-4… | |
| https://lists.debian.org/debian-lts-announce/2025… | |
| https://lists.debian.org/debian-lts-announce/2025… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
115.23.1 , ≤ 115.*
(rpm)
Unaffected: 128.10.1 , ≤ 128.* (rpm) Unaffected: 138.0.4 , ≤ * (rpm) |
|
| Mozilla | Thunderbird |
Unaffected:
128.10.2 , ≤ 128.*
(rpm)
Unaffected: 138.0.2 , ≤ * (rpm) |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-4918",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-20T03:55:17.219008Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T18:28:06.529Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T20:05:17.591Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.vicarius.io/vsociety/posts/cve-2025-4918-detect-firefox-out-of-bounds-write"
},
{
"url": "https://www.vicarius.io/vsociety/posts/cve-2025-4918-mitigate-firefox-out-of-bounds-write"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00046.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00024.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "115.*",
"status": "unaffected",
"version": "115.23.1",
"versionType": "rpm"
},
{
"lessThanOrEqual": "128.*",
"status": "unaffected",
"version": "128.10.1",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "138.0.4",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "128.*",
"status": "unaffected",
"version": "128.10.2",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "138.0.2",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Edouard Bochin and Tao Yan from Palo Alto Networks working with Trend Micro\u0027s Zero Day Initiative"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object. This vulnerability was fixed in Firefox 138.0.4, Firefox ESR 128.10.1, Firefox ESR 115.23.1, Thunderbird 128.10.2, and Thunderbird 138.0.2."
}
],
"value": "An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object. This vulnerability was fixed in Firefox 138.0.4, Firefox ESR 128.10.1, Firefox ESR 115.23.1, Thunderbird 128.10.2, and Thunderbird 138.0.2."
}
],
"providerMetadata": {
"dateUpdated": "2026-04-13T14:25:54.968Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1966612"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-36/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-37/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-38/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-40/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-41/"
}
],
"title": "Out-of-bounds access when resolving Promise objects"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2025-4918",
"datePublished": "2025-05-17T21:07:26.745Z",
"dateReserved": "2025-05-17T19:40:51.300Z",
"dateUpdated": "2026-04-13T14:25:54.968Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-4919 (GCVE-0-2025-4919)
Vulnerability from cvelistv5 – Published: 2025-05-17 21:07 – Updated: 2026-04-13 14:25
VLAI
EPSS
VEX
Title
Out-of-bounds access when optimizing linear sums
Summary
An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. This vulnerability was fixed in Firefox 138.0.4, Firefox ESR 128.10.1, Firefox ESR 115.23.1, Thunderbird 128.10.2, and Thunderbird 138.0.2.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-05-20 03:55 UTC
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=1966614 | |
| https://www.mozilla.org/security/advisories/mfsa2… | |
| https://www.mozilla.org/security/advisories/mfsa2… | |
| https://www.mozilla.org/security/advisories/mfsa2… | |
| https://www.mozilla.org/security/advisories/mfsa2… | |
| https://www.mozilla.org/security/advisories/mfsa2… | |
| https://lists.debian.org/debian-lts-announce/2025… | |
| https://lists.debian.org/debian-lts-announce/2025… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
115.23.1 , ≤ 115.*
(rpm)
Unaffected: 128.10.1 , ≤ 128.* (rpm) Unaffected: 138.0.4 , ≤ * (rpm) |
|
| Mozilla | Thunderbird |
Unaffected:
128.10.2 , ≤ 128.*
(rpm)
Unaffected: 138.0.2 , ≤ * (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-4919",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-20T03:55:18.550351Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T18:28:06.157Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T20:05:22.225Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00046.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00024.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "115.*",
"status": "unaffected",
"version": "115.23.1",
"versionType": "rpm"
},
{
"lessThanOrEqual": "128.*",
"status": "unaffected",
"version": "128.10.1",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "138.0.4",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "128.*",
"status": "unaffected",
"version": "128.10.2",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "138.0.2",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Manfred Paul working with Trend Micro\u0027s Zero Day Initiative"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. This vulnerability was fixed in Firefox 138.0.4, Firefox ESR 128.10.1, Firefox ESR 115.23.1, Thunderbird 128.10.2, and Thunderbird 138.0.2."
}
],
"value": "An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. This vulnerability was fixed in Firefox 138.0.4, Firefox ESR 128.10.1, Firefox ESR 115.23.1, Thunderbird 128.10.2, and Thunderbird 138.0.2."
}
],
"providerMetadata": {
"dateUpdated": "2026-04-13T14:25:56.780Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1966614"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-36/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-37/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-38/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-40/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-41/"
}
],
"title": "Out-of-bounds access when optimizing linear sums"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2025-4919",
"datePublished": "2025-05-17T21:07:27.734Z",
"dateReserved": "2025-05-17T19:40:53.416Z",
"dateUpdated": "2026-04-13T14:25:56.780Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-5263 (GCVE-0-2025-5263)
Vulnerability from cvelistv5 – Published: 2025-05-27 12:29 – Updated: 2026-04-13 14:27
VLAI
EPSS
VEX
Title
Error handling for script execution was incorrectly isolated from web content
Summary
Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin leak attacks. This vulnerability was fixed in Firefox 139, Firefox ESR 115.24, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-05-27 15:20 UTC
CWE
- CWE-346 - Origin Validation Error
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=1960745 | |
| https://www.mozilla.org/security/advisories/mfsa2… | |
| https://www.mozilla.org/security/advisories/mfsa2… | |
| https://www.mozilla.org/security/advisories/mfsa2… | |
| https://www.mozilla.org/security/advisories/mfsa2… | |
| https://www.mozilla.org/security/advisories/mfsa2… | |
| https://lists.debian.org/debian-lts-announce/2025… | |
| https://lists.debian.org/debian-lts-announce/2025… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
115.24 , ≤ 115.*
(rpm)
Unaffected: 128.11 , ≤ 128.* (rpm) Unaffected: 139 , ≤ * (rpm) |
|
| Mozilla | Thunderbird |
Unaffected:
128.11 , ≤ 128.*
(rpm)
Unaffected: 139 , ≤ * (rpm) |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-5263",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-27T15:20:12.961207Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346 Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-27T15:30:54.613Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T20:05:56.273Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00046.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00043.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "115.*",
"status": "unaffected",
"version": "115.24",
"versionType": "rpm"
},
{
"lessThanOrEqual": "128.*",
"status": "unaffected",
"version": "128.11",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "139",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "128.*",
"status": "unaffected",
"version": "128.11",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "139",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "terjanq"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin leak attacks. This vulnerability was fixed in Firefox 139, Firefox ESR 115.24, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11."
}
],
"value": "Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin leak attacks. This vulnerability was fixed in Firefox 139, Firefox ESR 115.24, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11."
}
],
"providerMetadata": {
"dateUpdated": "2026-04-13T14:27:56.730Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1960745"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-42/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-43/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-44/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-45/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-46/"
}
],
"title": "Error handling for script execution was incorrectly isolated from web content"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2025-5263",
"datePublished": "2025-05-27T12:29:22.686Z",
"dateReserved": "2025-05-27T12:29:22.271Z",
"dateUpdated": "2026-04-13T14:27:56.730Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-5264 (GCVE-0-2025-5264)
Vulnerability from cvelistv5 – Published: 2025-05-27 12:29 – Updated: 2026-04-13 14:27
VLAI
EPSS
VEX
Title
Potential local code execution in “Copy as cURL” command
Summary
Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. This vulnerability was fixed in Firefox 139, Firefox ESR 115.24, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-05-28 03:55 UTC
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=1950001 | |
| https://www.mozilla.org/security/advisories/mfsa2… | |
| https://www.mozilla.org/security/advisories/mfsa2… | |
| https://www.mozilla.org/security/advisories/mfsa2… | |
| https://www.mozilla.org/security/advisories/mfsa2… | |
| https://www.mozilla.org/security/advisories/mfsa2… | |
| https://lists.debian.org/debian-lts-announce/2025… | |
| https://lists.debian.org/debian-lts-announce/2025… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
115.24 , ≤ 115.*
(rpm)
Unaffected: 128.11 , ≤ 128.* (rpm) Unaffected: 139 , ≤ * (rpm) |
|
| Mozilla | Thunderbird |
Unaffected:
128.11 , ≤ 128.*
(rpm)
Unaffected: 139 , ≤ * (rpm) |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-5264",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-28T03:55:59.370030Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T18:27:56.150Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T20:05:59.028Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00046.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00043.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "115.*",
"status": "unaffected",
"version": "115.24",
"versionType": "rpm"
},
{
"lessThanOrEqual": "128.*",
"status": "unaffected",
"version": "128.11",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "139",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "128.*",
"status": "unaffected",
"version": "128.11",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "139",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Ameen Basha M K"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Due to insufficient escaping of the newline character in the \u201cCopy as cURL\u201d feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user\u0027s system. This vulnerability was fixed in Firefox 139, Firefox ESR 115.24, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11."
}
],
"value": "Due to insufficient escaping of the newline character in the \u201cCopy as cURL\u201d feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user\u0027s system. This vulnerability was fixed in Firefox 139, Firefox ESR 115.24, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11."
}
],
"providerMetadata": {
"dateUpdated": "2026-04-13T14:27:58.589Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1950001"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-42/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-43/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-44/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-45/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-46/"
}
],
"title": "Potential local code execution in \u201cCopy as cURL\u201d command"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2025-5264",
"datePublished": "2025-05-27T12:29:23.513Z",
"dateReserved": "2025-05-27T12:29:23.106Z",
"dateUpdated": "2026-04-13T14:27:58.589Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-5266 (GCVE-0-2025-5266)
Vulnerability from cvelistv5 – Published: 2025-05-27 12:29 – Updated: 2026-04-13 14:29
VLAI
EPSS
VEX
Title
Script element events leaked cross-origin resource status
Summary
Script elements loading cross-origin resources generated load and error events which leaked information enabling XS-Leaks attacks. This vulnerability was fixed in Firefox 139, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-23 14:44 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=1965628 | |
| https://www.mozilla.org/security/advisories/mfsa2… | |
| https://www.mozilla.org/security/advisories/mfsa2… | |
| https://www.mozilla.org/security/advisories/mfsa2… | |
| https://www.mozilla.org/security/advisories/mfsa2… | |
| https://lists.debian.org/debian-lts-announce/2025… | |
| https://lists.debian.org/debian-lts-announce/2025… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
128.11 , ≤ 128.*
(rpm)
Unaffected: 139 , ≤ * (rpm) |
|
| Mozilla | Thunderbird |
Unaffected:
128.11 , ≤ 128.*
(rpm)
Unaffected: 139 , ≤ * (rpm) |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-5266",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-23T14:44:04.447377Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-23T14:44:14.612Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T20:06:04.324Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00046.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00043.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "128.*",
"status": "unaffected",
"version": "128.11",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "139",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "128.*",
"status": "unaffected",
"version": "128.11",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "139",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Jakub Szymsza"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Script elements loading cross-origin resources generated load and error events which leaked information enabling XS-Leaks attacks. This vulnerability was fixed in Firefox 139, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11."
}
],
"value": "Script elements loading cross-origin resources generated load and error events which leaked information enabling XS-Leaks attacks. This vulnerability was fixed in Firefox 139, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11."
}
],
"providerMetadata": {
"dateUpdated": "2026-04-13T14:29:08.538Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1965628"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-42/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-44/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-45/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-46/"
}
],
"title": "Script element events leaked cross-origin resource status"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2025-5266",
"datePublished": "2025-05-27T12:29:25.084Z",
"dateReserved": "2025-05-27T12:29:24.726Z",
"dateUpdated": "2026-04-13T14:29:08.538Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-5267 (GCVE-0-2025-5267)
Vulnerability from cvelistv5 – Published: 2025-05-27 12:29 – Updated: 2026-04-13 14:29
VLAI
EPSS
VEX
Title
Clickjacking vulnerability could have led to leaking saved payment card details
Summary
A clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious page. This vulnerability was fixed in Firefox 139, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-05-27 17:44 UTC
CWE
- CWE-1021 - Improper Restriction of Rendered UI Layers or Frames
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=1954137 | |
| https://www.mozilla.org/security/advisories/mfsa2… | |
| https://www.mozilla.org/security/advisories/mfsa2… | |
| https://www.mozilla.org/security/advisories/mfsa2… | |
| https://www.mozilla.org/security/advisories/mfsa2… | |
| https://lists.debian.org/debian-lts-announce/2025… | |
| https://lists.debian.org/debian-lts-announce/2025… |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Mozilla | Firefox |
Unaffected:
128.11 , ≤ 128.*
(rpm)
Unaffected: 139 , ≤ * (rpm) |
|
| Mozilla | Thunderbird |
Unaffected:
128.11 , ≤ 128.*
(rpm)
Unaffected: 139 , ≤ * (rpm) |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-5267",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-27T17:44:29.781576Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1021",
"description": "CWE-1021 Improper Restriction of Rendered UI Layers or Frames",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-27T17:45:24.804Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T20:06:07.099Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00046.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00043.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "128.*",
"status": "unaffected",
"version": "128.11",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "139",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "128.*",
"status": "unaffected",
"version": "128.11",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "139",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Ameen Basha M K"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious page. This vulnerability was fixed in Firefox 139, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11."
}
],
"value": "A clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious page. This vulnerability was fixed in Firefox 139, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11."
}
],
"providerMetadata": {
"dateUpdated": "2026-04-13T14:29:10.584Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1954137"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-42/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-44/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-45/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-46/"
}
],
"title": "Clickjacking vulnerability could have led to leaking saved payment card details"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2025-5267",
"datePublished": "2025-05-27T12:29:25.942Z",
"dateReserved": "2025-05-27T12:29:25.508Z",
"dateUpdated": "2026-04-13T14:29:10.584Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…
Loading…