Vulnerability-Lookup

CVE-2025-8037 (GCVE-0-2025-8037)

Vulnerability from cvelistv5 – Published: 2025-07-22 20:49 – Updated: 2026-07-29 14:55

Title

Nameless cookies shadow secure cookies

Summary

Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie included the `Secure` attribute. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-07-23 14:22 UTC

CWE

CWE-614 - Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 509 records in the last 180 days details

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=1964767
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version	CPE status
Mozilla	Firefox	Unaffected: 140.1 , ≤ 140.* (rpm) Unaffected: 141 , ≤ * (rpm)	guessed
Mozilla	Thunderbird	Unaffected: 140.1 , ≤ 140.* (rpm) Unaffected: 141 , ≤ * (rpm)	guessed

Credits

Uku Sõrmus

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-8037",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-23T14:22:54.948290Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-614",
                "description": "CWE-614 Sensitive Cookie in HTTPS Session Without \u0027Secure\u0027 Attribute",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-29T14:55:07.468Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.1",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "141",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.1",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "141",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Uku S\u00f5rmus"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie included the \u003ccode\u003eSecure\u003c/code\u003e attribute. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1."
            }
          ],
          "value": "Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie included the `Secure` attribute. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-13T14:26:53.773Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1964767"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-56/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-59/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-61/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-63/"
        }
      ],
      "title": "Nameless cookies shadow secure cookies"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2025-8037",
    "datePublished": "2025-07-22T20:49:25.621Z",
    "dateReserved": "2025-07-22T10:14:04.585Z",
    "dateUpdated": "2026-07-29T14:55:07.468Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-8037",
      "date": "2026-10-26",
      "epss": "0.00266",
      "percentile": "0.18601"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "Firefox",
                "vendor": "Mozilla",
                "versions": [
                  {
                    "lessThanOrEqual": "140.*",
                    "status": "unaffected",
                    "version": "140.1",
                    "versionType": "rpm"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "141",
                    "versionType": "rpm"
                  }
                ]
              },
              {
                "product": "Thunderbird",
                "vendor": "Mozilla",
                "versions": [
                  {
                    "lessThanOrEqual": "140.*",
                    "status": "unaffected",
                    "version": "140.1",
                    "versionType": "rpm"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "141",
                    "versionType": "rpm"
                  }
                ]
              }
            ],
            "source": "security@mozilla.org"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*",
                    "matchCriteriaId": "260CDC56-79EC-44BF-9555-BB4321552203",
                    "versionEndExcluding": "140.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*",
                    "matchCriteriaId": "8684A46E-D70A-4830-8971-A6DCC360F422",
                    "versionEndExcluding": "141.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*",
                    "matchCriteriaId": "99498D75-7441-458F-9C53-6ABCC7ED9AEC",
                    "versionEndExcluding": "140.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*",
                    "matchCriteriaId": "95D506DD-BD9B-4D90-802F-5BE673F1CF14",
                    "versionEndExcluding": "141.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie included the `Secure` attribute. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1."
          },
          {
            "lang": "es",
            "value": "Al configurar una cookie sin nombre con un signo igual en su valor, se eclipsaban otras cookies. Incluso si la cookie sin nombre se configuraba mediante HTTP y la cookie eclipsada inclu\u00eda el atributo \u201cSecure\u201d. Esta vulnerabilidad afecta a Firefox menor que 141, Firefox ESR menor que 140.1, Thunderbird menor que 141 y Thunderbird menor que 140.1."
          }
        ],
        "id": "CVE-2025-8037",
        "lastModified": "2026-10-05T15:10:00.590",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 9.1,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.2,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-8037",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-23T14:22:54.948290Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-07-22T21:15:50.860",
        "references": [
          {
            "source": "security@mozilla.org",
            "tags": [
              "Permissions Required"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1964767"
          },
          {
            "source": "security@mozilla.org",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2025-56/"
          },
          {
            "source": "security@mozilla.org",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2025-59/"
          },
          {
            "source": "security@mozilla.org",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2025-61/"
          },
          {
            "source": "security@mozilla.org",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2025-63/"
          }
        ],
        "sourceIdentifier": "security@mozilla.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-614"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-30T01:49:55+00:00",
      "cve": "CVE-2025-8037",
      "id": "CVE-2025-8037",
      "initial_release_date": "2025-07-22T20:49:25.621000+00:00",
      "product_status:known_not_affected": "23",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "firefox: thunderbird: Nameless cookies shadow secure cookies",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-8037.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "NONE",
                  "baseScore": 9.1,
                  "baseSeverity": "CRITICAL",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "HIGH",
                  "privilegesRequired": "NONE",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-8037",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-07-23T14:22:54.948290Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-614",
                    "description": "CWE-614 Sensitive Cookie in HTTPS Session Without \u0027Secure\u0027 Attribute",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-07-23T14:25:17.912Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "Firefox",
              "vendor": "Mozilla",
              "versions": [
                {
                  "lessThanOrEqual": "140.*",
                  "status": "unaffected",
                  "version": "140.1",
                  "versionType": "rpm"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "141",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "product": "Thunderbird",
              "vendor": "Mozilla",
              "versions": [
                {
                  "lessThanOrEqual": "140.*",
                  "status": "unaffected",
                  "version": "140.1",
                  "versionType": "rpm"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "141",
                  "versionType": "rpm"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "value": "Uku S\u00f5rmus"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie included the \u003ccode\u003eSecure\u003c/code\u003e attribute. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1."
                }
              ],
              "value": "Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie included the `Secure` attribute. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1."
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-04-13T14:26:53.773Z",
            "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
            "shortName": "mozilla"
          },
          "references": [
            {
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1964767"
            },
            {
              "url": "https://www.mozilla.org/security/advisories/mfsa2025-56/"
            },
            {
              "url": "https://www.mozilla.org/security/advisories/mfsa2025-59/"
            },
            {
              "url": "https://www.mozilla.org/security/advisories/mfsa2025-61/"
            },
            {
              "url": "https://www.mozilla.org/security/advisories/mfsa2025-63/"
            }
          ],
          "title": "Nameless cookies shadow secure cookies"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "assignerShortName": "mozilla",
        "cveId": "CVE-2025-8037",
        "datePublished": "2025-07-22T20:49:25.621Z",
        "dateReserved": "2025-07-22T10:14:04.585Z",
        "dateUpdated": "2026-07-29T14:55:07.468Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

OESA-2025-2361 (CVE-2025-10527)

Vulnerability from osv_openeuler – Published: 2025-10-11 11:09 – Updated: 2026-08-06 11:09 – Source website

Summary

firefox security update

Details

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global moz_debug_prefix /lib/debug %global moz_debug_dir /lib/debug/ %global uname_m %(uname -m) %global symbols_file_name -.en-US.-%(uname.crashreporter-symbols.zip %global symbols_file_path /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip %global _find_debuginfo_opts -p /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip -o debugcrashreporter.list %global crashreporter_pkg_name mozilla-crashreporter--debuginfo

Security Fix(es):

This vulnerability affects Firefox versions prior to 143 and Firefox ESR versions prior to 140.3. Specific vulnerability type and impact details require further confirmation.(CVE-2025-10527)

This vulnerability affects Firefox < 143 and Firefox ESR < 140.3.(CVE-2025-10528)

This vulnerability affects Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3.(CVE-2025-10529)

This vulnerability affects Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3.(CVE-2025-10532)

This vulnerability affects Firefox < 143, Firefox ESR < 115.28, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3.(CVE-2025-10533)

This vulnerability affects Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3.(CVE-2025-10536)

Memory safety bugs present in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3.(CVE-2025-10537)

Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.(CVE-2025-8036)

Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie included the Secure attribute. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.(CVE-2025-8037)

Thunderbird ignored paths when checking the validity of navigations in a frame. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.(CVE-2025-8038)

In some cases search terms persisted in the URL bar even after navigating away from the search page. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.(CVE-2025-8039)

Memory safety bugs present in Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.(CVE-2025-8040)

Spoofing issue in the Address Bar component. This vulnerability affects Firefox < 142 and Firefox ESR < 140.2.(CVE-2025-9183)

Severity

9.8 (Critical)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-10527	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-10528	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-10529	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-10532	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-10533	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-10536	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-10537	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-8036	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-8037	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-8038	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-8039	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-8040	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-9183	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "firefox-128.14.0-1.oe2403.aarch64.rpm",
          "firefox-debuginfo-128.14.0-1.oe2403.aarch64.rpm",
          "firefox-debugsource-128.14.0-1.oe2403.aarch64.rpm"
        ],
        "src": [
          "firefox-128.14.0-1.oe2403.src.rpm"
        ],
        "x86_64": [
          "firefox-128.14.0-1.oe2403.x86_64.rpm",
          "firefox-debuginfo-128.14.0-1.oe2403.x86_64.rpm",
          "firefox-debugsource-128.14.0-1.oe2403.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS",
        "name": "firefox",
        "purl": "pkg:rpm/openEuler/firefox\u0026distro=openEuler-24.03-LTS"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "128.14.0-1.oe2403"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Critical"
  },
  "details": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global moz_debug_prefix /lib/debug %global moz_debug_dir /lib/debug/ %global uname_m %(uname -m) %global symbols_file_name -.en-US.-%(uname.crashreporter-symbols.zip %global symbols_file_path /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip %global _find_debuginfo_opts -p /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip -o debugcrashreporter.list %global crashreporter_pkg_name mozilla-crashreporter--debuginfo\r\n\r\nSecurity Fix(es):\n\nThis vulnerability affects Firefox versions prior to 143 and Firefox ESR versions prior to 140.3. Specific vulnerability type and impact details require further confirmation.(CVE-2025-10527)\n\nThis vulnerability affects Firefox \u0026lt; 143 and Firefox ESR \u0026lt; 140.3.(CVE-2025-10528)\n\nThis vulnerability affects Firefox \u0026lt; 143, Firefox ESR \u0026lt; 140.3, Thunderbird \u0026lt; 143, and Thunderbird \u0026lt; 140.3.(CVE-2025-10529)\n\nThis vulnerability affects Firefox \u0026lt; 143, Firefox ESR \u0026lt; 140.3, Thunderbird \u0026lt; 143, and Thunderbird \u0026lt; 140.3.(CVE-2025-10532)\n\nThis vulnerability affects Firefox \u0026lt; 143, Firefox ESR \u0026lt; 115.28, Firefox ESR \u0026lt; 140.3, Thunderbird \u0026lt; 143, and Thunderbird \u0026lt; 140.3.(CVE-2025-10533)\n\nThis vulnerability affects Firefox \u0026lt; 143, Firefox ESR \u0026lt; 140.3, Thunderbird \u0026lt; 143, and Thunderbird \u0026lt; 140.3.(CVE-2025-10536)\n\nMemory safety bugs present in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u0026lt; 143, Firefox ESR \u0026lt; 140.3, Thunderbird \u0026lt; 143, and Thunderbird \u0026lt; 140.3.(CVE-2025-10537)\n\nThunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability affects Firefox \u0026lt; 141, Firefox ESR \u0026lt; 140.1, Thunderbird \u0026lt; 141, and Thunderbird \u0026lt; 140.1.(CVE-2025-8036)\n\nSetting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie included the `Secure` attribute. This vulnerability affects Firefox \u0026lt; 141, Firefox ESR \u0026lt; 140.1, Thunderbird \u0026lt; 141, and Thunderbird \u0026lt; 140.1.(CVE-2025-8037)\n\nThunderbird ignored paths when checking the validity of navigations in a frame. This vulnerability affects Firefox \u0026lt; 141, Firefox ESR \u0026lt; 140.1, Thunderbird \u0026lt; 141, and Thunderbird \u0026lt; 140.1.(CVE-2025-8038)\n\nIn some cases search terms persisted in the URL bar even after navigating away from the search page. This vulnerability affects Firefox \u0026lt; 141, Firefox ESR \u0026lt; 140.1, Thunderbird \u0026lt; 141, and Thunderbird \u0026lt; 140.1.(CVE-2025-8039)\n\nMemory safety bugs present in Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u0026lt; 141, Firefox ESR \u0026lt; 140.1, Thunderbird \u0026lt; 141, and Thunderbird \u0026lt; 140.1.(CVE-2025-8040)\n\nSpoofing issue in the Address Bar component. This vulnerability affects Firefox \u0026lt; 142 and Firefox ESR \u0026lt; 140.2.(CVE-2025-9183)",
  "id": "OESA-2025-2361",
  "modified": "2026-08-06T11:09:26Z",
  "published": "2025-10-11T11:09:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2361"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10527"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10528"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10529"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10532"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10533"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10536"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10537"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8036"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8037"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8038"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8039"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8040"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9183"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "firefox security update",
  "upstream": [
    "CVE-2025-10527",
    "CVE-2025-10528",
    "CVE-2025-10529",
    "CVE-2025-10532",
    "CVE-2025-10533",
    "CVE-2025-10536",
    "CVE-2025-10537",
    "CVE-2025-8036",
    "CVE-2025-8037",
    "CVE-2025-8038",
    "CVE-2025-8039",
    "CVE-2025-8040",
    "CVE-2025-9183"
  ]
}

OPENSUSE-SU-2025:15371-1

Vulnerability from csaf_opensuse - Published: 2025-07-23 00:00 - Updated: 2026-09-20 21:38

Summary

firefox-esr-140.1.0-1.1 on GA media

Severity

Moderate

Scope

22 vulnerabilities in this advisory, including CVE-2025-8037.

CVE-2025-8037

5.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Recommended: 16 products

Open the full advisory

OPENSUSE-SU-2025:15383-1

Vulnerability from csaf_opensuse - Published: 2025-07-25 00:00 - Updated: 2026-09-20 21:38

Summary

MozillaThunderbird-140.1.0-1.1 on GA media

Severity

Moderate

Scope

20 vulnerabilities in this advisory, including CVE-2025-8037.

CVE-2025-8037

5.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Recommended: 16 products

Open the full advisory

OPENSUSE-SU-2025:15386-1

Vulnerability from csaf_opensuse - Published: 2025-07-26 00:00 - Updated: 2026-09-20 21:38

Summary

MozillaFirefox-141.0-1.1 on GA media

Severity

Moderate

Scope

18 vulnerabilities in this advisory, including CVE-2025-8037.

CVE-2025-8037

5.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Recommended: 20 products

Open the full advisory

SUSE-SU-2025:02529-1

Vulnerability from csaf_suse - Published: 2025-07-25 17:35 - Updated: 2025-07-25 17:35

Summary

Security update for MozillaFirefox, MozillaFirefox-branding-SLE

Severity

Important

Scope

27 vulnerabilities in this advisory, including CVE-2025-8037.

CVE-2025-8037

5.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Recommended: 475 products

Open the full advisory

SUSE-SU-2025:02531-1

Vulnerability from csaf_suse - Published: 2025-07-28 06:04 - Updated: 2026-09-20 17:35

Summary

Security update for MozillaFirefox

Severity

Important

Scope

14 vulnerabilities in this advisory, including CVE-2025-8037.

CVE-2025-8037

5.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Recommended: 39 products

Open the full advisory

SUSE-SU-2025:02546-1

Vulnerability from csaf_suse - Published: 2025-07-30 07:34 - Updated: 2025-07-30 07:34

Summary

Security update for MozillaThunderbird

Severity

Important

Scope

25 vulnerabilities in this advisory, including CVE-2025-8037.

CVE-2025-8037

5.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Recommended: 36 products

Open the full advisory

UBUNTU-CVE-2025-8037 (CVE-2025-8037)

Vulnerability from osv_ubuntu – Published: 2025-07-22 21:15 – Updated: 2026-10-21 07:35 – Source website

Details

Severity

9.1 (Critical)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2025-8037	REPORT
	https://www.cve.org/CVERecord?id=CVE-2025-8037	REPORT
	https://www.mozilla.org/en-US/security/advisories…	REPORT
	https://bugzilla.mozilla.org/show_bug.cgi?id=1964767	REPORT
	https://www.mozilla.org/security/advisories/mfsa2…	REPORT
	https://www.mozilla.org/security/advisories/mfsa2…	REPORT
	https://www.mozilla.org/security/advisories/mfsa2…	REPORT
	https://www.mozilla.org/security/advisories/mfsa2…	REPORT
	https://ubuntu.com/security/notices/USN-7991-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libmozjs-52-0",
            "binary_version": "52.9.1-0ubuntu0.18.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "mozjs52",
        "purl": "pkg:deb/ubuntu/mozjs52@52.9.1-0ubuntu0.18.04.1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "52.3.1-0ubuntu3",
        "52.3.1-7fakesync1",
        "52.8.1-0ubuntu0.18.04.1",
        "52.9.1-0ubuntu0.18.04.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libmozjs-38-0",
            "binary_version": "38.8.0~repack1-0ubuntu4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "mozjs38",
        "purl": "pkg:deb/ubuntu/mozjs38@38.8.0~repack1-0ubuntu4?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "38.8.0~repack1-0ubuntu1",
        "38.8.0~repack1-0ubuntu3",
        "38.8.0~repack1-0ubuntu4"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libmozjs-68-0",
            "binary_version": "68.6.0-1ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "mozjs68",
        "purl": "pkg:deb/ubuntu/mozjs68@68.6.0-1ubuntu1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "68.5.0-1~fakesync",
        "68.5.0-2~fakesync",
        "68.6.0-1",
        "68.6.0-1ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libmozjs-52-0",
            "binary_version": "52.9.1-1ubuntu3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "mozjs52",
        "purl": "pkg:deb/ubuntu/mozjs52@52.9.1-1ubuntu3?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "52.9.1-1build1",
        "52.9.1-1ubuntu3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libmozjs-102-0",
            "binary_version": "102.15.1-0ubuntu0.22.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "mozjs102",
        "purl": "pkg:deb/ubuntu/mozjs102@102.15.1-0ubuntu0.22.04.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "102.11.0-0ubuntu0.22.04.1",
        "102.12.0-0ubuntu0.22.04.1",
        "102.13.0-0ubuntu0.22.04.1",
        "102.15.1-0ubuntu0.22.04.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libmozjs-78-0",
            "binary_version": "78.15.0-4ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "mozjs78",
        "purl": "pkg:deb/ubuntu/mozjs78@78.15.0-4ubuntu1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "78.13.0-1",
        "78.15.0-2",
        "78.15.0-4ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libmozjs-91-0",
            "binary_version": "91.10.0-0ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "mozjs91",
        "purl": "pkg:deb/ubuntu/mozjs91@91.10.0-0ubuntu1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "91.5.1-0ubuntu1",
        "91.6.0-1",
        "91.6.0-2",
        "91.7.0-2",
        "91.10.0-0ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "thunderbird",
            "binary_version": "1:140.7.1+build1-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "thunderbird-gnome-support",
            "binary_version": "1:140.7.1+build1-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "thunderbird-mozsymbols",
            "binary_version": "1:140.7.1+build1-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "xul-ext-calendar-timezones",
            "binary_version": "1:140.7.1+build1-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "xul-ext-gdata-provider",
            "binary_version": "1:140.7.1+build1-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "xul-ext-lightning",
            "binary_version": "1:140.7.1+build1-0ubuntu0.22.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "thunderbird",
        "purl": "pkg:deb/ubuntu/thunderbird@1:140.7.1+build1-0ubuntu0.22.04.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:140.7.1+build1-0ubuntu0.22.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:91.1.2+build1-0ubuntu1",
        "1:91.3.0+build2-0ubuntu1",
        "1:91.3.1+build1-0ubuntu1",
        "1:91.3.2+build1-0ubuntu1",
        "1:91.4.0+build1.1-0ubuntu1",
        "1:91.4.0+build2-0ubuntu1",
        "1:91.5.0+build1-0ubuntu1",
        "1:91.5.1+build1-0ubuntu1",
        "1:91.6.1+build1-0ubuntu1",
        "1:91.7.0+build1-0ubuntu1",
        "1:91.7.0+build2-0ubuntu1",
        "1:91.8.0+build2-0ubuntu1",
        "1:91.9.1+build1-0ubuntu0.22.04.1",
        "1:91.11.0+build2-0ubuntu0.22.04.1",
        "1:102.2.2+build1-0ubuntu0.22.04.1",
        "1:102.4.2+build2-0ubuntu0.22.04.1",
        "1:102.7.1+build2-0ubuntu0.22.04.1",
        "1:102.8.0+build2-0ubuntu0.22.04.1",
        "1:102.9.0+build1-0ubuntu0.22.04.1",
        "1:102.10.0+build2-0ubuntu0.22.04.1",
        "1:102.11.0+build1-0ubuntu0.22.04.1",
        "1:102.13.0+build1-0ubuntu0.22.04.1",
        "1:102.15.0+build1-0ubuntu0.22.04.1",
        "1:102.15.1+build1-0ubuntu0.22.04.1",
        "1:115.3.1+build1-0ubuntu0.22.04.2",
        "1:115.4.1+build1-0ubuntu0.22.04.1",
        "1:115.5.0+build1-0ubuntu0.22.04.1",
        "1:115.6.0+build2-0ubuntu0.22.04.1",
        "1:115.8.1+build1-0ubuntu0.22.04.1",
        "1:115.9.0+build1-0ubuntu0.22.04.1",
        "1:115.10.1+build1-0ubuntu0.22.04.1",
        "1:115.11.0+build2-0ubuntu0.22.04.1",
        "1:115.12.0+build3-0ubuntu0.22.04.1",
        "1:115.13.0+build5-0ubuntu0.22.04.1",
        "1:115.15.0+build1-0ubuntu0.22.04.1",
        "1:115.16.0+build2-0ubuntu0.22.04.1",
        "1:115.18.0+build1-0ubuntu0.22.04.1",
        "1:128.12.0+build1-0ubuntu0.22.04.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libmozjs-102-0t64",
            "binary_version": "102.15.1-3ubuntu2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "mozjs102",
        "purl": "pkg:deb/ubuntu/mozjs102@102.15.1-3ubuntu2?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "102.15.1-1",
        "102.15.1-3ubuntu2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libmozjs-115-0t64",
            "binary_version": "115.10.0-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "mozjs115",
        "purl": "pkg:deb/ubuntu/mozjs115@115.10.0-1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "115.3.0-0ubuntu1",
        "115.4.0-2",
        "115.5.0-1",
        "115.6.0-1",
        "115.7.0-4",
        "115.8.0-1",
        "115.9.0-1",
        "115.9.0-1build1",
        "115.10.0-1"
      ]
    }
  ],
  "aliases": [],
  "details": "Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie included the `Secure` attribute. This vulnerability affects Firefox \u003c 141, Firefox ESR \u003c 140.1, Thunderbird \u003c 141, and Thunderbird \u003c 140.1.",
  "id": "UBUNTU-CVE-2025-8037",
  "modified": "2026-10-21T07:35:27Z",
  "published": "2025-07-22T21:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-8037"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-8037"
    },
    {
      "type": "REPORT",
      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2025-56/#CVE-2025-8037"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1964767"
    },
    {
      "type": "REPORT",
      "url": "https://www.mozilla.org/security/advisories/mfsa2025-56/"
    },
    {
      "type": "REPORT",
      "url": "https://www.mozilla.org/security/advisories/mfsa2025-59/"
    },
    {
      "type": "REPORT",
      "url": "https://www.mozilla.org/security/advisories/mfsa2025-61/"
    },
    {
      "type": "REPORT",
      "url": "https://www.mozilla.org/security/advisories/mfsa2025-63/"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-7991-1"
    }
  ],
  "related": [
    "USN-7991-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2025-8037"
  ]
}

WID-SEC-W-2025-1623

Vulnerability from csaf_certbund - Published: 2025-07-22 22:00 - Updated: 2026-06-11 22:00

Summary

Mozilla Firefox , Firefox ESR und Thunderbird: Mehrere Schwachstellen

Severity

Hoch

Scope

21 vulnerabilities in this advisory, including CVE-2025-8037.

CVE-2025-8037

Known affected: 20 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-8037 (GCVE-0-2025-8037)

OESA-2025-2361 (CVE-2025-10527)

OPENSUSE-SU-2025:15371-1

OPENSUSE-SU-2025:15383-1

OPENSUSE-SU-2025:15386-1

SUSE-SU-2025:02529-1

SUSE-SU-2025:02531-1

SUSE-SU-2025:02546-1

UBUNTU-CVE-2025-8037 (CVE-2025-8037)

WID-SEC-W-2025-1623

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour