Vulnerability-Lookup

CVE-2025-6424 (GCVE-0-2025-6424)

Vulnerability from cvelistv5 – Published: 2025-06-24 12:27 – Updated: 2026-04-13 14:26

Title

Use-after-free in FontFaceSet

Summary

A use-after-free in FontFaceSet resulted in a potentially exploitable crash. This vulnerability was fixed in Firefox 140, Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-06-25 12:36 UTC

CWE

CWE-416 - Use After Free

Assigner

mozilla mitre root

References

8 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=1966423
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version	CPE status
Mozilla	Firefox	Unaffected: 115.25 , ≤ 115.* (rpm) Unaffected: 128.12 , ≤ 128.* (rpm) Unaffected: 140 , ≤ * (rpm)	guessed
Mozilla	Thunderbird	Unaffected: 128.12 , ≤ 128.* (rpm) Unaffected: 140 , ≤ * (rpm)	guessed

Credits

LJP and HexRabbit (DEVCORE Research Team)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-6424",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-25T12:36:06.501007Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-25T12:42:03.245Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:06:57.283Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00002.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/06/msg00029.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.25",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "128.*",
              "status": "unaffected",
              "version": "128.12",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "140",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "128.*",
              "status": "unaffected",
              "version": "128.12",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "140",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "LJP and HexRabbit (DEVCORE Research Team)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A use-after-free in FontFaceSet resulted in a potentially exploitable crash. This vulnerability was fixed in Firefox 140, Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12."
            }
          ],
          "value": "A use-after-free in FontFaceSet resulted in a potentially exploitable crash. This vulnerability was fixed in Firefox 140, Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-13T14:26:04.861Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1966423"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-51/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-52/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-53/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-54/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2025-55/"
        }
      ],
      "title": "Use-after-free in FontFaceSet"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2025-6424",
    "datePublished": "2025-06-24T12:27:59.669Z",
    "dateReserved": "2025-06-20T14:51:26.620Z",
    "dateUpdated": "2026-04-13T14:26:04.861Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-6424",
      "date": "2026-09-19",
      "epss": "0.03618",
      "percentile": "0.88979"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "Firefox",
                "vendor": "Mozilla",
                "versions": [
                  {
                    "lessThanOrEqual": "115.*",
                    "status": "unaffected",
                    "version": "115.25",
                    "versionType": "rpm"
                  },
                  {
                    "lessThanOrEqual": "128.*",
                    "status": "unaffected",
                    "version": "128.12",
                    "versionType": "rpm"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "140",
                    "versionType": "rpm"
                  }
                ]
              },
              {
                "product": "Thunderbird",
                "vendor": "Mozilla",
                "versions": [
                  {
                    "lessThanOrEqual": "128.*",
                    "status": "unaffected",
                    "version": "128.12",
                    "versionType": "rpm"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "140",
                    "versionType": "rpm"
                  }
                ]
              }
            ],
            "source": "security@mozilla.org"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*",
                    "matchCriteriaId": "CC066347-9B64-4991-AD04-A52785491963",
                    "versionEndExcluding": "115.25.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*",
                    "matchCriteriaId": "77D2BF2A-26A3-4664-93B5-B41BCF17AC9E",
                    "versionEndExcluding": "140.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*",
                    "matchCriteriaId": "152204C0-14F9-4342-8BDF-EE016A70C203",
                    "versionEndExcluding": "128.12.0",
                    "versionStartIncluding": "116.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A use-after-free in FontFaceSet resulted in a potentially exploitable crash. This vulnerability was fixed in Firefox 140, Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12."
          },
          {
            "lang": "es",
            "value": "Use-after-free en FontFaceSet provoc\u00f3 un bloqueo potencialmente explotable. Esta vulnerabilidad afecta a Firefox \u0026lt; 140, Firefox ESR \u0026lt; 115.25 y Firefox ESR \u0026lt; 128.12."
          }
        ],
        "id": "CVE-2025-6424",
        "lastModified": "2026-06-17T10:01:51.673",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-6424",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-25T12:36:06.501007Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-06-24T13:15:23.273",
        "references": [
          {
            "source": "security@mozilla.org",
            "tags": [
              "Permissions Required"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1966423"
          },
          {
            "source": "security@mozilla.org",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2025-51/"
          },
          {
            "source": "security@mozilla.org",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2025-52/"
          },
          {
            "source": "security@mozilla.org",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2025-53/"
          },
          {
            "source": "security@mozilla.org",
            "url": "https://www.mozilla.org/security/advisories/mfsa2025-54/"
          },
          {
            "source": "security@mozilla.org",
            "url": "https://www.mozilla.org/security/advisories/mfsa2025-55/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2025/06/msg00029.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00002.html"
          }
        ],
        "sourceIdentifier": "security@mozilla.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-06-29T20:43:26+00:00",
      "cve": "CVE-2025-6424",
      "id": "CVE-2025-6424",
      "initial_release_date": "2025-06-24T12:27:59.669000+00:00",
      "product_status:fixed": "253",
      "product_status:known_affected": "8",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "firefox: thunderbird: Use-after-free in FontFaceSet",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-6424.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-30T02:09:25Z",
      "cve": "CVE-2025-6424",
      "id": "CVE-2025-6424",
      "initial_release_date": "2025-06-24T23:24:47Z",
      "product_status:known_affected": "73",
      "product_status:recommended": "355",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-6424",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-6424.json",
      "version": "38"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2025-11-03T20:06:57.283Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00002.html"
              },
              {
                "url": "https://lists.debian.org/debian-lts-announce/2025/06/msg00029.html"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "HIGH",
                  "baseScore": 9.8,
                  "baseSeverity": "CRITICAL",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "HIGH",
                  "privilegesRequired": "NONE",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-6424",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-06-25T12:36:06.501007Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-416",
                    "description": "CWE-416 Use After Free",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-06-25T12:36:38.938Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "Firefox",
              "vendor": "Mozilla",
              "versions": [
                {
                  "lessThanOrEqual": "115.*",
                  "status": "unaffected",
                  "version": "115.25",
                  "versionType": "rpm"
                },
                {
                  "lessThanOrEqual": "128.*",
                  "status": "unaffected",
                  "version": "128.12",
                  "versionType": "rpm"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "140",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "product": "Thunderbird",
              "vendor": "Mozilla",
              "versions": [
                {
                  "lessThanOrEqual": "128.*",
                  "status": "unaffected",
                  "version": "128.12",
                  "versionType": "rpm"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "140",
                  "versionType": "rpm"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "value": "LJP and HexRabbit (DEVCORE Research Team)"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "A use-after-free in FontFaceSet resulted in a potentially exploitable crash. This vulnerability was fixed in Firefox 140, Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12."
                }
              ],
              "value": "A use-after-free in FontFaceSet resulted in a potentially exploitable crash. This vulnerability was fixed in Firefox 140, Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12."
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-04-13T14:26:04.861Z",
            "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
            "shortName": "mozilla"
          },
          "references": [
            {
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1966423"
            },
            {
              "url": "https://www.mozilla.org/security/advisories/mfsa2025-51/"
            },
            {
              "url": "https://www.mozilla.org/security/advisories/mfsa2025-52/"
            },
            {
              "url": "https://www.mozilla.org/security/advisories/mfsa2025-53/"
            },
            {
              "url": "https://www.mozilla.org/security/advisories/mfsa2025-54/"
            },
            {
              "url": "https://www.mozilla.org/security/advisories/mfsa2025-55/"
            }
          ],
          "title": "Use-after-free in FontFaceSet"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "assignerShortName": "mozilla",
        "cveId": "CVE-2025-6424",
        "datePublished": "2025-06-24T12:27:59.669Z",
        "dateReserved": "2025-06-20T14:51:26.620Z",
        "dateUpdated": "2026-04-13T14:26:04.861Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CNVD-2025-15492

Vulnerability from cnvd - Published: 2025-07-11

Title

多款Mozilla产品内存错误漏洞

Description

Mozilla Firefox是一款开源Web浏览器。Mozilla Firefox ESR是Firefox（Web浏览器）的一个延长支持版本。Mozilla Thunderbird是一套从Mozilla Application Suite独立出来的电子邮件客户端软件。多款Mozilla产品存在内存错误漏洞，攻击者可利用该漏洞导致绝服务。

Severity

高

Patch Name

多款Mozilla产品内存错误漏洞的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://www.mozilla.org/security/advisories/mfsa2025-51/ https://www.mozilla.org/security/advisories/mfsa2025-52/ https://www.mozilla.org/security/advisories/mfsa2025-53/ https://www.mozilla.org/security/advisories/mfsa2025-54/ https://www.mozilla.org/security/advisories/mfsa2025-55/

Reference

https://nvd.nist.gov/vuln/detail/CVE-2025-6424

Impacted products

Name
['Mozilla Firefox <140', 'Mozilla Firefox ESR <128.12', 'Mozilla Firefox ESR <115.25', 'mozilla Thunderbird <140', 'mozilla Thunderbird <128.12']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2025-6424",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2025-6424"
    }
  },
  "description": "Mozilla Firefox\u662f\u4e00\u6b3e\u5f00\u6e90Web\u6d4f\u89c8\u5668\u3002Mozilla Firefox ESR\u662fFirefox\uff08Web\u6d4f\u89c8\u5668\uff09\u7684\u4e00\u4e2a\u5ef6\u957f\u652f\u6301\u7248\u672c\u3002Mozilla Thunderbird\u662f\u4e00\u5957\u4eceMozilla Application Suite\u72ec\u7acb\u51fa\u6765\u7684\u7535\u5b50\u90ae\u4ef6\u5ba2\u6237\u7aef\u8f6f\u4ef6\u3002\n \n\u591a\u6b3eMozilla\u4ea7\u54c1\u5b58\u5728\u5185\u5b58\u9519\u8bef\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u7edd\u670d\u52a1\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.mozilla.org/security/advisories/mfsa2025-51/\r\nhttps://www.mozilla.org/security/advisories/mfsa2025-52/\r\nhttps://www.mozilla.org/security/advisories/mfsa2025-53/\r\nhttps://www.mozilla.org/security/advisories/mfsa2025-54/\r\nhttps://www.mozilla.org/security/advisories/mfsa2025-55/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-15492",
  "openTime": "2025-07-11",
  "patchDescription": "Mozilla Firefox\u662f\u4e00\u6b3e\u5f00\u6e90Web\u6d4f\u89c8\u5668\u3002Mozilla Firefox ESR\u662fFirefox\uff08Web\u6d4f\u89c8\u5668\uff09\u7684\u4e00\u4e2a\u5ef6\u957f\u652f\u6301\u7248\u672c\u3002Mozilla Thunderbird\u662f\u4e00\u5957\u4eceMozilla Application Suite\u72ec\u7acb\u51fa\u6765\u7684\u7535\u5b50\u90ae\u4ef6\u5ba2\u6237\u7aef\u8f6f\u4ef6\u3002\r\n \r\n\u591a\u6b3eMozilla\u4ea7\u54c1\u5b58\u5728\u5185\u5b58\u9519\u8bef\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u7edd\u670d\u52a1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u6b3eMozilla\u4ea7\u54c1\u5185\u5b58\u9519\u8bef\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Mozilla Firefox \u003c140",
      "Mozilla Firefox ESR \u003c128.12",
      "Mozilla Firefox ESR \u003c115.25",
      "mozilla Thunderbird \u003c140",
      "mozilla Thunderbird \u003c128.12"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2025-6424",
  "serverity": "\u9ad8",
  "submitTime": "2025-07-04",
  "title": "\u591a\u6b3eMozilla\u4ea7\u54c1\u5185\u5b58\u9519\u8bef\u6f0f\u6d1e"
}

FKIE_CVE-2025-6424

Vulnerability from fkie_nvd - Published: 2025-06-24 13:15 - Updated: 2026-06-17 10:01

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
security@mozilla.org	https://bugzilla.mozilla.org/show_bug.cgi?id=1966423	Permissions Required
security@mozilla.org	https://www.mozilla.org/security/advisories/mfsa2025-51/	Vendor Advisory
security@mozilla.org	https://www.mozilla.org/security/advisories/mfsa2025-52/	Vendor Advisory
security@mozilla.org	https://www.mozilla.org/security/advisories/mfsa2025-53/	Vendor Advisory
security@mozilla.org	https://www.mozilla.org/security/advisories/mfsa2025-54/
security@mozilla.org	https://www.mozilla.org/security/advisories/mfsa2025-55/
af854a3a-2127-422b-91ae-364da2661108	https://lists.debian.org/debian-lts-announce/2025/06/msg00029.html
af854a3a-2127-422b-91ae-364da2661108	https://lists.debian.org/debian-lts-announce/2025/07/msg00002.html

Impacted products

Vendor	Product	Version
mozilla	firefox	*
mozilla	firefox	*
mozilla	firefox	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "115.*",
              "status": "unaffected",
              "version": "115.25",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "128.*",
              "status": "unaffected",
              "version": "128.12",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "140",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "128.*",
              "status": "unaffected",
              "version": "128.12",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "140",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "source": "security@mozilla.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*",
              "matchCriteriaId": "CC066347-9B64-4991-AD04-A52785491963",
              "versionEndExcluding": "115.25.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*",
              "matchCriteriaId": "77D2BF2A-26A3-4664-93B5-B41BCF17AC9E",
              "versionEndExcluding": "140.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*",
              "matchCriteriaId": "152204C0-14F9-4342-8BDF-EE016A70C203",
              "versionEndExcluding": "128.12.0",
              "versionStartIncluding": "116.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A use-after-free in FontFaceSet resulted in a potentially exploitable crash. This vulnerability was fixed in Firefox 140, Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12."
    },
    {
      "lang": "es",
      "value": "Use-after-free en FontFaceSet provoc\u00f3 un bloqueo potencialmente explotable. Esta vulnerabilidad afecta a Firefox \u0026lt; 140, Firefox ESR \u0026lt; 115.25 y Firefox ESR \u0026lt; 128.12."
    }
  ],
  "id": "CVE-2025-6424",
  "lastModified": "2026-06-17T10:01:51.673",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-6424",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-06-25T12:36:06.501007Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-06-24T13:15:23.273",
  "references": [
    {
      "source": "security@mozilla.org",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1966423"
    },
    {
      "source": "security@mozilla.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.mozilla.org/security/advisories/mfsa2025-51/"
    },
    {
      "source": "security@mozilla.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.mozilla.org/security/advisories/mfsa2025-52/"
    },
    {
      "source": "security@mozilla.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.mozilla.org/security/advisories/mfsa2025-53/"
    },
    {
      "source": "security@mozilla.org",
      "url": "https://www.mozilla.org/security/advisories/mfsa2025-54/"
    },
    {
      "source": "security@mozilla.org",
      "url": "https://www.mozilla.org/security/advisories/mfsa2025-55/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.debian.org/debian-lts-announce/2025/06/msg00029.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00002.html"
    }
  ],
  "sourceIdentifier": "security@mozilla.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-87C4-94W2-RW7J

Vulnerability from github – Published: 2025-06-26 21:31 – Updated: 2025-11-03 21:34

Details

A use-after-free in FontFaceSet resulted in a potentially exploitable crash. This vulnerability affects Firefox < 140, Firefox ESR < 115.25, and Firefox ESR < 128.12.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-6424"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-06-24T13:15:23Z",
    "severity": "CRITICAL"
  },
  "details": "A use-after-free in FontFaceSet resulted in a potentially exploitable crash. This vulnerability affects Firefox \u003c 140, Firefox ESR \u003c 115.25, and Firefox ESR \u003c 128.12.",
  "id": "GHSA-87c4-94w2-rw7j",
  "modified": "2025-11-03T21:34:04Z",
  "published": "2025-06-26T21:31:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6424"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1966423"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/06/msg00029.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00002.html"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2025-51"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2025-52"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2025-53"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2025-54"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2025-55"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

OESA-2025-1717 (CVE-2025-6424)

Vulnerability from osv_openeuler – Published: 2025-07-04 11:08 – Updated: 2026-08-06 11:08 – Source website

Summary

firefox security update

Details

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global moz_debug_prefix /lib/debug %global moz_debug_dir /lib/debug/ %global uname_m %(uname -m) %global symbols_file_name -.en-US.-%(uname.crashreporter-symbols.zip %global symbols_file_path /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip %global _find_debuginfo_opts -p /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip -o debugcrashreporter.list %global crashreporter_pkg_name mozilla-crashreporter--debuginfo

Security Fix(es):

A vulnerability was found in Mozilla Firefox up to 139 (Web Browser). It has been rated as critical.Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.Impacted is confidentiality, integrity, and availability.Upgrading to version 140 eliminates this vulnerability.(CVE-2025-6424)

An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between containers and normal/private browsing mode, but not profiles. This vulnerability affects Firefox < 140, Firefox ESR < 115.25, Firefox ESR < 128.12, Thunderbird < 140, and Thunderbird < 128.12.(CVE-2025-6425)

Firefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an embed tag. This could have bypassed website security checks that restricted which domains users were allowed to embed. This vulnerability affects Firefox < 140 and Firefox ESR < 128.12.(CVE-2025-6429)

When a file download is specified via the Content-Disposition header, that directive would be ignored if the file was included via a &lt;embed&gt; or &lt;object&gt; tag, potentially making a website vulnerable to a cross-site scripting attack. This vulnerability affects Firefox < 140 and Firefox ESR < 128.12.(CVE-2025-6430)

Severity

9.8 (Critical)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-6424	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-6425	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-6429	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-6430	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "firefox-128.12.0-1.oe2203sp3.aarch64.rpm",
          "firefox-debuginfo-128.12.0-1.oe2203sp3.aarch64.rpm",
          "firefox-debugsource-128.12.0-1.oe2203sp3.aarch64.rpm"
        ],
        "src": [
          "firefox-128.12.0-1.oe2203sp3.src.rpm"
        ],
        "x86_64": [
          "firefox-128.12.0-1.oe2203sp3.x86_64.rpm",
          "firefox-debuginfo-128.12.0-1.oe2203sp3.x86_64.rpm",
          "firefox-debugsource-128.12.0-1.oe2203sp3.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP3",
        "name": "firefox",
        "purl": "pkg:rpm/openEuler/firefox\u0026distro=openEuler-22.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "128.12.0-1.oe2203sp3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Critical"
  },
  "details": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global moz_debug_prefix /lib/debug %global moz_debug_dir /lib/debug/ %global uname_m %(uname -m) %global symbols_file_name -.en-US.-%(uname.crashreporter-symbols.zip %global symbols_file_path /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip %global _find_debuginfo_opts -p /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip -o debugcrashreporter.list %global crashreporter_pkg_name mozilla-crashreporter--debuginfo\r\n\r\nSecurity Fix(es):\n\nA vulnerability was found in Mozilla Firefox up to 139 (Web Browser). It has been rated as critical.Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.Impacted is confidentiality, integrity, and availability.Upgrading to version 140 eliminates this vulnerability.(CVE-2025-6424)\n\nAn attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between containers and normal/private browsing mode, but not profiles. This vulnerability affects Firefox \u0026lt; 140, Firefox ESR \u0026lt; 115.25, Firefox ESR \u0026lt; 128.12, Thunderbird \u0026lt; 140, and Thunderbird \u0026lt; 128.12.(CVE-2025-6425)\n\nFirefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an `embed` tag.  This could have bypassed website security checks that restricted which domains users were allowed to embed. This vulnerability affects Firefox \u0026lt; 140 and Firefox ESR \u0026lt; 128.12.(CVE-2025-6429)\n\nWhen a file download is specified via the `Content-Disposition` header, that directive would be ignored if the file was included via a `\u0026amp;lt;embed\u0026amp;gt;` or `\u0026amp;lt;object\u0026amp;gt;` tag, potentially making a website vulnerable to a cross-site scripting attack. This vulnerability affects Firefox \u0026lt; 140 and Firefox ESR \u0026lt; 128.12.(CVE-2025-6430)",
  "id": "OESA-2025-1717",
  "modified": "2026-08-06T11:08:48Z",
  "published": "2025-07-04T11:08:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1717"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6424"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6425"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6429"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6430"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "firefox security update",
  "upstream": [
    "CVE-2025-6424",
    "CVE-2025-6425",
    "CVE-2025-6429",
    "CVE-2025-6430"
  ]
}

OESA-2025-1718 (CVE-2025-6424)

Vulnerability from osv_openeuler – Published: 2025-07-04 11:08 – Updated: 2026-08-06 11:08 – Source website

Summary

firefox security update

Details

Security Fix(es):

Severity

9.8 (Critical)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-6424	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-6425	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-6429	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-6430	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "firefox-128.12.0-1.oe2203sp4.aarch64.rpm",
          "firefox-debuginfo-128.12.0-1.oe2203sp4.aarch64.rpm",
          "firefox-debugsource-128.12.0-1.oe2203sp4.aarch64.rpm"
        ],
        "src": [
          "firefox-128.12.0-1.oe2203sp4.src.rpm"
        ],
        "x86_64": [
          "firefox-128.12.0-1.oe2203sp4.x86_64.rpm",
          "firefox-debuginfo-128.12.0-1.oe2203sp4.x86_64.rpm",
          "firefox-debugsource-128.12.0-1.oe2203sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP4",
        "name": "firefox",
        "purl": "pkg:rpm/openEuler/firefox\u0026distro=openEuler-22.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "128.12.0-1.oe2203sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Critical"
  },
  "details": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global moz_debug_prefix /lib/debug %global moz_debug_dir /lib/debug/ %global uname_m %(uname -m) %global symbols_file_name -.en-US.-%(uname.crashreporter-symbols.zip %global symbols_file_path /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip %global _find_debuginfo_opts -p /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip -o debugcrashreporter.list %global crashreporter_pkg_name mozilla-crashreporter--debuginfo\r\n\r\nSecurity Fix(es):\n\nA vulnerability was found in Mozilla Firefox up to 139 (Web Browser). It has been rated as critical.Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.Impacted is confidentiality, integrity, and availability.Upgrading to version 140 eliminates this vulnerability.(CVE-2025-6424)\n\nAn attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between containers and normal/private browsing mode, but not profiles. This vulnerability affects Firefox \u0026lt; 140, Firefox ESR \u0026lt; 115.25, Firefox ESR \u0026lt; 128.12, Thunderbird \u0026lt; 140, and Thunderbird \u0026lt; 128.12.(CVE-2025-6425)\n\nFirefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an `embed` tag.  This could have bypassed website security checks that restricted which domains users were allowed to embed. This vulnerability affects Firefox \u0026lt; 140 and Firefox ESR \u0026lt; 128.12.(CVE-2025-6429)\n\nWhen a file download is specified via the `Content-Disposition` header, that directive would be ignored if the file was included via a `\u0026amp;lt;embed\u0026amp;gt;` or `\u0026amp;lt;object\u0026amp;gt;` tag, potentially making a website vulnerable to a cross-site scripting attack. This vulnerability affects Firefox \u0026lt; 140 and Firefox ESR \u0026lt; 128.12.(CVE-2025-6430)",
  "id": "OESA-2025-1718",
  "modified": "2026-08-06T11:08:48Z",
  "published": "2025-07-04T11:08:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1718"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6424"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6425"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6429"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6430"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "firefox security update",
  "upstream": [
    "CVE-2025-6424",
    "CVE-2025-6425",
    "CVE-2025-6429",
    "CVE-2025-6430"
  ]
}

OESA-2025-1719 (CVE-2025-6424)

Vulnerability from osv_openeuler – Published: 2025-07-04 11:08 – Updated: 2026-08-06 11:08 – Source website

Summary

firefox security update

Details

Security Fix(es):

Severity

9.8 (Critical)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-6424	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-6425	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-6429	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-6430	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "firefox-128.12.0-1.oe2403.aarch64.rpm",
          "firefox-debuginfo-128.12.0-1.oe2403.aarch64.rpm",
          "firefox-debugsource-128.12.0-1.oe2403.aarch64.rpm"
        ],
        "src": [
          "firefox-128.12.0-1.oe2403.src.rpm"
        ],
        "x86_64": [
          "firefox-128.12.0-1.oe2403.x86_64.rpm",
          "firefox-debuginfo-128.12.0-1.oe2403.x86_64.rpm",
          "firefox-debugsource-128.12.0-1.oe2403.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS",
        "name": "firefox",
        "purl": "pkg:rpm/openEuler/firefox\u0026distro=openEuler-24.03-LTS"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "128.12.0-1.oe2403"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Critical"
  },
  "details": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global moz_debug_prefix /lib/debug %global moz_debug_dir /lib/debug/ %global uname_m %(uname -m) %global symbols_file_name -.en-US.-%(uname.crashreporter-symbols.zip %global symbols_file_path /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip %global _find_debuginfo_opts -p /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip -o debugcrashreporter.list %global crashreporter_pkg_name mozilla-crashreporter--debuginfo\r\n\r\nSecurity Fix(es):\n\nA vulnerability was found in Mozilla Firefox up to 139 (Web Browser). It has been rated as critical.Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.Impacted is confidentiality, integrity, and availability.Upgrading to version 140 eliminates this vulnerability.(CVE-2025-6424)\n\nAn attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between containers and normal/private browsing mode, but not profiles. This vulnerability affects Firefox \u0026lt; 140, Firefox ESR \u0026lt; 115.25, Firefox ESR \u0026lt; 128.12, Thunderbird \u0026lt; 140, and Thunderbird \u0026lt; 128.12.(CVE-2025-6425)\n\nFirefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an `embed` tag.  This could have bypassed website security checks that restricted which domains users were allowed to embed. This vulnerability affects Firefox \u0026lt; 140 and Firefox ESR \u0026lt; 128.12.(CVE-2025-6429)\n\nWhen a file download is specified via the `Content-Disposition` header, that directive would be ignored if the file was included via a `\u0026amp;lt;embed\u0026amp;gt;` or `\u0026amp;lt;object\u0026amp;gt;` tag, potentially making a website vulnerable to a cross-site scripting attack. This vulnerability affects Firefox \u0026lt; 140 and Firefox ESR \u0026lt; 128.12.(CVE-2025-6430)",
  "id": "OESA-2025-1719",
  "modified": "2026-08-06T11:08:48Z",
  "published": "2025-07-04T11:08:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1719"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6424"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6425"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6429"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6430"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "firefox security update",
  "upstream": [
    "CVE-2025-6424",
    "CVE-2025-6425",
    "CVE-2025-6429",
    "CVE-2025-6430"
  ]
}

OESA-2025-1720 (CVE-2025-6424)

Vulnerability from osv_openeuler – Published: 2025-07-04 11:08 – Updated: 2026-08-06 11:08 – Source website

Summary

firefox security update

Details

Security Fix(es):

Severity

9.8 (Critical)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-6424	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-6425	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-6429	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-6430	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "firefox-128.12.0-1.oe2403sp1.aarch64.rpm",
          "firefox-debuginfo-128.12.0-1.oe2403sp1.aarch64.rpm",
          "firefox-debugsource-128.12.0-1.oe2403sp1.aarch64.rpm"
        ],
        "src": [
          "firefox-128.12.0-1.oe2403sp1.src.rpm"
        ],
        "x86_64": [
          "firefox-128.12.0-1.oe2403sp1.x86_64.rpm",
          "firefox-debuginfo-128.12.0-1.oe2403sp1.x86_64.rpm",
          "firefox-debugsource-128.12.0-1.oe2403sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP1",
        "name": "firefox",
        "purl": "pkg:rpm/openEuler/firefox\u0026distro=openEuler-24.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "128.12.0-1.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Critical"
  },
  "details": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global moz_debug_prefix /lib/debug %global moz_debug_dir /lib/debug/ %global uname_m %(uname -m) %global symbols_file_name -.en-US.-%(uname.crashreporter-symbols.zip %global symbols_file_path /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip %global _find_debuginfo_opts -p /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip -o debugcrashreporter.list %global crashreporter_pkg_name mozilla-crashreporter--debuginfo\r\n\r\nSecurity Fix(es):\n\nA vulnerability was found in Mozilla Firefox up to 139 (Web Browser). It has been rated as critical.Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.Impacted is confidentiality, integrity, and availability.Upgrading to version 140 eliminates this vulnerability.(CVE-2025-6424)\n\nAn attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between containers and normal/private browsing mode, but not profiles. This vulnerability affects Firefox \u0026lt; 140, Firefox ESR \u0026lt; 115.25, Firefox ESR \u0026lt; 128.12, Thunderbird \u0026lt; 140, and Thunderbird \u0026lt; 128.12.(CVE-2025-6425)\n\nFirefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an `embed` tag.  This could have bypassed website security checks that restricted which domains users were allowed to embed. This vulnerability affects Firefox \u0026lt; 140 and Firefox ESR \u0026lt; 128.12.(CVE-2025-6429)\n\nWhen a file download is specified via the `Content-Disposition` header, that directive would be ignored if the file was included via a `\u0026amp;lt;embed\u0026amp;gt;` or `\u0026amp;lt;object\u0026amp;gt;` tag, potentially making a website vulnerable to a cross-site scripting attack. This vulnerability affects Firefox \u0026lt; 140 and Firefox ESR \u0026lt; 128.12.(CVE-2025-6430)",
  "id": "OESA-2025-1720",
  "modified": "2026-08-06T11:08:48Z",
  "published": "2025-07-04T11:08:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1720"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6424"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6425"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6429"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6430"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "firefox security update",
  "upstream": [
    "CVE-2025-6424",
    "CVE-2025-6425",
    "CVE-2025-6429",
    "CVE-2025-6430"
  ]
}

OESA-2025-1782 (CVE-2025-6424)

Vulnerability from osv_openeuler – Published: 2025-07-11 11:08 – Updated: 2026-08-06 11:08 – Source website

Summary

firefox security update

Details

Security Fix(es):

Severity

9.8 (Critical)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-6424	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-6425	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-6429	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-6430	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "firefox-128.12.0-1.oe2403sp2.aarch64.rpm",
          "firefox-debuginfo-128.12.0-1.oe2403sp2.aarch64.rpm",
          "firefox-debugsource-128.12.0-1.oe2403sp2.aarch64.rpm"
        ],
        "src": [
          "firefox-128.12.0-1.oe2403sp2.src.rpm"
        ],
        "x86_64": [
          "firefox-128.12.0-1.oe2403sp2.x86_64.rpm",
          "firefox-debuginfo-128.12.0-1.oe2403sp2.x86_64.rpm",
          "firefox-debugsource-128.12.0-1.oe2403sp2.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP2",
        "name": "firefox",
        "purl": "pkg:rpm/openEuler/firefox\u0026distro=openEuler-24.03-LTS-SP2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "128.12.0-1.oe2403sp2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Critical"
  },
  "details": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global moz_debug_prefix /lib/debug %global moz_debug_dir /lib/debug/ %global uname_m %(uname -m) %global symbols_file_name -.en-US.-%(uname.crashreporter-symbols.zip %global symbols_file_path /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip %global _find_debuginfo_opts -p /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip -o debugcrashreporter.list %global crashreporter_pkg_name mozilla-crashreporter--debuginfo\r\n\r\nSecurity Fix(es):\n\nA vulnerability was found in Mozilla Firefox up to 139 (Web Browser). It has been rated as critical.Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.Impacted is confidentiality, integrity, and availability.Upgrading to version 140 eliminates this vulnerability.(CVE-2025-6424)\n\nAn attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between containers and normal/private browsing mode, but not profiles. This vulnerability affects Firefox \u0026lt; 140, Firefox ESR \u0026lt; 115.25, Firefox ESR \u0026lt; 128.12, Thunderbird \u0026lt; 140, and Thunderbird \u0026lt; 128.12.(CVE-2025-6425)\n\nFirefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an `embed` tag.  This could have bypassed website security checks that restricted which domains users were allowed to embed. This vulnerability affects Firefox \u0026lt; 140 and Firefox ESR \u0026lt; 128.12.(CVE-2025-6429)\n\nWhen a file download is specified via the `Content-Disposition` header, that directive would be ignored if the file was included via a `\u0026amp;lt;embed\u0026amp;gt;` or `\u0026amp;lt;object\u0026amp;gt;` tag, potentially making a website vulnerable to a cross-site scripting attack. This vulnerability affects Firefox \u0026lt; 140 and Firefox ESR \u0026lt; 128.12.(CVE-2025-6430)",
  "id": "OESA-2025-1782",
  "modified": "2026-08-06T11:08:52Z",
  "published": "2025-07-11T11:08:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1782"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6424"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6425"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6429"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6430"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "firefox security update",
  "upstream": [
    "CVE-2025-6424",
    "CVE-2025-6425",
    "CVE-2025-6429",
    "CVE-2025-6430"
  ]
}

OESA-2025-1912 (CVE-2025-6424)

Vulnerability from osv_openeuler – Published: 2025-07-25 11:08 – Updated: 2026-08-06 11:08 – Source website

Summary

thunderbird security update

Details

Security Fix(es):

A use-after-free in FontFaceSet resulted in a potentially exploitable crash. This vulnerability affects Firefox < 140, Firefox ESR < 115.25, Firefox ESR < 128.12, Thunderbird < 140, and Thunderbird < 128.12.(CVE-2025-6424)

Severity

9.8 (Critical)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-6424	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-6425	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-6429	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-6430	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "thunderbird-128.12.0-1.oe2403sp2.aarch64.rpm",
          "thunderbird-debuginfo-128.12.0-1.oe2403sp2.aarch64.rpm",
          "thunderbird-debugsource-128.12.0-1.oe2403sp2.aarch64.rpm",
          "thunderbird-librnp-rnp-128.12.0-1.oe2403sp2.aarch64.rpm",
          "thunderbird-wayland-128.12.0-1.oe2403sp2.aarch64.rpm"
        ],
        "src": [
          "thunderbird-128.12.0-1.oe2403sp2.src.rpm"
        ],
        "x86_64": [
          "thunderbird-128.12.0-1.oe2403sp2.x86_64.rpm",
          "thunderbird-debuginfo-128.12.0-1.oe2403sp2.x86_64.rpm",
          "thunderbird-debugsource-128.12.0-1.oe2403sp2.x86_64.rpm",
          "thunderbird-librnp-rnp-128.12.0-1.oe2403sp2.x86_64.rpm",
          "thunderbird-wayland-128.12.0-1.oe2403sp2.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP2",
        "name": "thunderbird",
        "purl": "pkg:rpm/openEuler/thunderbird\u0026distro=openEuler-24.03-LTS-SP2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "128.12.0-1.oe2403sp2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Critical"
  },
  "details": "Security Fix(es):\n\nA use-after-free in FontFaceSet resulted in a potentially exploitable crash. This vulnerability affects Firefox \u0026lt; 140, Firefox ESR \u0026lt; 115.25, Firefox ESR \u0026lt; 128.12, Thunderbird \u0026lt; 140, and Thunderbird \u0026lt; 128.12.(CVE-2025-6424)\n\nAn attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between containers and normal/private browsing mode, but not profiles. This vulnerability affects Firefox \u0026lt; 140, Firefox ESR \u0026lt; 115.25, Firefox ESR \u0026lt; 128.12, Thunderbird \u0026lt; 140, and Thunderbird \u0026lt; 128.12.(CVE-2025-6425)\n\nFirefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an `embed` tag.  This could have bypassed website security checks that restricted which domains users were allowed to embed. This vulnerability affects Firefox \u0026lt; 140, Firefox ESR \u0026lt; 128.12, Thunderbird \u0026lt; 140, and Thunderbird \u0026lt; 128.12.(CVE-2025-6429)\n\nWhen a file download is specified via the `Content-Disposition` header, that directive would be ignored if the file was included via a `\u0026amp;lt;embed\u0026amp;gt;` or `\u0026amp;lt;object\u0026amp;gt;` tag, potentially making a website vulnerable to a cross-site scripting attack. This vulnerability affects Firefox \u0026lt; 140 and Firefox ESR \u0026lt; 128.12.(CVE-2025-6430)",
  "id": "OESA-2025-1912",
  "modified": "2026-08-06T11:08:59Z",
  "published": "2025-07-25T11:08:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1912"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6424"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6425"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6429"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6430"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "thunderbird security update",
  "upstream": [
    "CVE-2025-6424",
    "CVE-2025-6425",
    "CVE-2025-6429",
    "CVE-2025-6430"
  ]
}

OPENSUSE-SU-2025-20135-1

Vulnerability from csaf_opensuse - Published: 2025-12-03 20:41 - Updated: 2025-12-03 20:41

Summary

Security update for mozjs128

Severity

Important

Scope

26 vulnerabilities in this advisory, including CVE-2025-6424.

CVE-2025-6424

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Recommended: 12 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-6424 (GCVE-0-2025-6424)

CNVD-2025-15492

FKIE_CVE-2025-6424

GHSA-87C4-94W2-RW7J

OESA-2025-1717 (CVE-2025-6424)

OESA-2025-1718 (CVE-2025-6424)

OESA-2025-1719 (CVE-2025-6424)

OESA-2025-1720 (CVE-2025-6424)

OESA-2025-1782 (CVE-2025-6424)

OESA-2025-1912 (CVE-2025-6424)

OPENSUSE-SU-2025-20135-1

Tags

Sightings

Nomenclature

Related by attack behaviour