Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues:
Changes in MozillaFirefox:
Firefox Extended Support Release 140.5.0 ESR:
- Fixed: Various security fixes (MFSA 2025-88 bsc#1253188):
- CVE-2025-13012
Race condition in the Graphics component
Incorrect boundary conditions in the JavaScript: WebAssembly
component
Same-origin policy bypass in the DOM: Notifications component
Mitigation bypass in the DOM: Security component
Same-origin policy bypass in the DOM: Workers component
Mitigation bypass in the DOM: Core & HTML component
Use-after-free in the WebRTC: Audio/Video component
Use-after-free in the Audio/Video component
Spoofing issue in Firefox
- Firefox Extended Support Release 140.4.0 ESR
- Fixed: Various security fixes.
MFSA 2025-83 (bsc#1251263)
Use-after-free in MediaTrackGraphImpl::GetInstance()
Out of bounds read/write in a privileged process triggered by
WebGL textures
Cross-process information leaked due to malicious IPC
messages
Some non-writable Object properties could be modified
An OBJECT tag type attribute overrode browser behavior on web
resources without a content-type
Potential user-assisted code execution in “Copy as cURL”
command
Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR
140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144
Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird
ESR 140.4, Firefox 144 and Thunderbird 144
- Firefox Extended Support Release 140.3.1 ESR (bsc#1250452)
- Fixed: Improved reliability when HTTP/3 connections fail:
Firefox no longer forces HTTP/2 during fallback, allowing the
server to choose the protocol and preventing stalls on some
sites.
Firefox Extended Support Release 140.3.0 ESR
- Fixed: Various security fixes (MFSA 2025-75 bsc#1249391)
- CVE-2025-10527
Sandbox escape due to use-after-free in the Graphics:
Canvas2D component
Sandbox escape due to undefined behavior, invalid pointer in
the Graphics: Canvas2D component
Same-origin policy bypass in the Layout component
Incorrect boundary conditions in the JavaScript: GC component
Integer overflow in the SVG component
Information disclosure in the Networking: Cache component
Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird
ESR 140.3, Firefox 143 and Thunderbird 143
