--===============7082898455400899494== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit
# Security update for MozillaFirefox
Announcement ID: SUSE-SU-2025:0391-1 Release Date: 2025-02-10T07:34:07Z Rating: important References:
* bsc#1236539
Cross-References:
* CVE-2024-11704 * CVE-2025-1009 * CVE-2025-1010 * CVE-2025-1011 * CVE-2025-1012 * CVE-2025-1013 * CVE-2025-1014 * CVE-2025-1016 * CVE-2025-1017
CVSS scores:
* CVE-2024-11704 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2025-1009 ( SUSE ): 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H * CVE-2025-1009 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2025-1009 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2025-1010 ( SUSE ): 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H * CVE-2025-1010 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2025-1010 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2025-1011 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2025-1011 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2025-1011 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2025-1012 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2025-1012 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2025-1012 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2025-1013 ( SUSE ): 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N * CVE-2025-1013 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2025-1014 ( SUSE ): 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L * CVE-2025-1014 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2025-1014 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2025-1016 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2025-1016 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2025-1016 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2025-1017 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2025-1017 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2025-1017 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products:
* SUSE Linux Enterprise High Performance Computing 12 SP5 * SUSE Linux Enterprise Server 12 SP5 * SUSE Linux Enterprise Server 12 SP5 LTSS * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security * SUSE Linux Enterprise Server for SAP Applications 12 SP5
An update that solves nine vulnerabilities can now be installed.
## Description:
This update for MozillaFirefox to 128.7esr fixes the following issues:
* MFSA 2025-09 * CVE-2025-1009 (bmo#1936613) Use-after-free in XSLT * CVE-2025-1010 (bmo#1936982) Use-after-free in Custom Highlight * CVE-2025-1011 (bmo#1936454) A bug in WebAssembly code generation could result in a crash * CVE-2025-1012 (bmo#1939710) Use-after-free during concurrent delazification * CVE-2024-11704 (bmo#1899402) Potential double-free vulnerability in PKCS#7 decryption handling * CVE-2025-1013 (bmo#1932555) Potential opening of private browsing tabs in normal browsing windows * CVE-2025-1014 (bmo#1940804) Certificate length was not properly checked * CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694, bmo#1938469, bmo#1939583, bmo#1940994) Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20, and Thunderbird 128.7 * CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984) Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product:
* SUSE Linux Enterprise Server 12 SP5 LTSS zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-2025-391=1
* SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2025-391=1
## Package List:
* SUSE Linux Enterprise Server 12 SP5 LTSS (aarch64 ppc64le s390x x86_64) * MozillaFirefox-translations-common-128.7.0-112.246.1 * MozillaFirefox-128.7.0-112.246.1 * MozillaFirefox-debugsource-128.7.0-112.246.1 * MozillaFirefox-debuginfo-128.7.0-112.246.1 * SUSE Linux Enterprise Server 12 SP5 LTSS (noarch) * MozillaFirefox-devel-128.7.0-112.246.1 * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (x86_64) * MozillaFirefox-translations-common-128.7.0-112.246.1 * MozillaFirefox-128.7.0-112.246.1 * MozillaFirefox-debugsource-128.7.0-112.246.1 * MozillaFirefox-debuginfo-128.7.0-112.246.1 * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (noarch) * MozillaFirefox-devel-128.7.0-112.246.1
## References:
* https://www.suse.com/security/cve/CVE-2024-11704.html * https://www.suse.com/security/cve/CVE-2025-1009.html * https://www.suse.com/security/cve/CVE-2025-1010.html * https://www.suse.com/security/cve/CVE-2025-1011.html * https://www.suse.com/security/cve/CVE-2025-1012.html * https://www.suse.com/security/cve/CVE-2025-1013.html * https://www.suse.com/security/cve/CVE-2025-1014.html * https://www.suse.com/security/cve/CVE-2025-1016.html * https://www.suse.com/security/cve/CVE-2025-1017.html * https://bugzilla.suse.com/show_bug.cgi?id=1236539
--===============7082898455400899494== Content-Type: text/html; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit
<div class="container"> <h1>Security update for MozillaFirefox</h1>
<table class="table table-striped table-bordered"> <tbody> <tr> <th>Announcement ID:</th> <td>SUSE-SU-2025:0391-1</td> </tr> <tr> <th>Release Date:</th> <td>2025-02-10T07:34:07Z</td> </tr> <tr> <th>Rating:</th> <td>important</td> </tr> <tr> <th>References:</th> <td> <ul> <li style="display: inline;"> <a href="https://bugzilla.suse.com/show_bug.cgi?id=1236539">bsc#1236539</a> </li> </ul> </td> </tr> <tr> <th> Cross-References: </th> <td> <ul> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2024-11704.html">CVE-2024-11704</a> </li> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2025-1009.html">CVE-2025-1009</a> </li> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2025-1010.html">CVE-2025-1010</a> </li> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2025-1011.html">CVE-2025-1011</a> </li> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2025-1012.html">CVE-2025-1012</a> </li> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2025-1013.html">CVE-2025-1013</a> </li> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2025-1014.html">CVE-2025-1014</a> </li> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2025-1016.html">CVE-2025-1016</a> </li> <li style="display: inline;"> <a href="https://www.suse.com/security/cve/CVE-2025-1017.html">CVE-2025-1017</a> </li> </ul> </td> </tr> <tr> <th>CVSS scores:</th> <td> <ul class="list-group"> <li class="list-group-item"> <span class="cvss-reference">CVE-2024-11704</span> <span class="cvss-source"> ( NVD ): </span> <span class="cvss-score">9.8</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2025-1009</span> <span class="cvss-source"> ( SUSE ): </span> <span class="cvss-score">7.6</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2025-1009</span> <span class="cvss-source"> ( NVD ): </span> <span class="cvss-score">9.8</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2025-1009</span> <span class="cvss-source"> ( NVD ): </span> <span class="cvss-score">9.8</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2025-1010</span> <span class="cvss-source"> ( SUSE ): </span> <span class="cvss-score">7.6</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2025-1010</span> <span class="cvss-source"> ( NVD ): </span> <span class="cvss-score">8.8</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2025-1010</span> <span class="cvss-source"> ( NVD ): </span> <span class="cvss-score">9.8</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2025-1011</span> <span class="cvss-source"> ( SUSE ): </span> <span class="cvss-score">8.8</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2025-1011</span> <span class="cvss-source"> ( NVD ): </span> <span class="cvss-score">9.8</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2025-1011</span> <span class="cvss-source"> ( NVD ): </span> <span class="cvss-score">8.8</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2025-1012</span> <span class="cvss-source"> ( SUSE ): </span> <span class="cvss-score">7.5</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2025-1012</span> <span class="cvss-source"> ( NVD ): </span> <span class="cvss-score">7.5</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2025-1012</span> <span class="cvss-source"> ( NVD ): </span> <span class="cvss-score">9.8</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2025-1013</span> <span class="cvss-source"> ( SUSE ): </span> <span class="cvss-score">3.1</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2025-1013</span> <span class="cvss-source"> ( NVD ): </span> <span class="cvss-score">6.5</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2025-1014</span> <span class="cvss-source"> ( SUSE ): </span> <span class="cvss-score">5.3</span> <span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2025-1014</span> <span class="cvss-source"> ( NVD ): </span> <span class="cvss-score">8.8</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2025-1014</span> <span class="cvss-source"> ( NVD ): </span> <span class="cvss-score">8.8</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2025-1016</span> <span class="cvss-source"> ( SUSE ): </span> <span class="cvss-score">8.8</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2025-1016</span> <span class="cvss-source"> ( NVD ): </span> <span class="cvss-score">9.8</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2025-1016</span> <span class="cvss-source"> ( NVD ): </span> <span class="cvss-score">9.8</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2025-1017</span> <span class="cvss-source"> ( SUSE ): </span> <span class="cvss-score">8.8</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2025-1017</span> <span class="cvss-source"> ( NVD ): </span> <span class="cvss-score">9.8</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</span> </li> <li class="list-group-item"> <span class="cvss-reference">CVE-2025-1017</span> <span class="cvss-source"> ( NVD ): </span> <span class="cvss-score">9.8</span> <span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</span> </li> </ul> </td> </tr> <tr> <th>Affected Products:</th> <td> <ul class="list-group"> <li class="list-group-item">SUSE Linux Enterprise High Performance Computing 12 SP5</li> <li class="list-group-item">SUSE Linux Enterprise Server 12 SP5</li> <li class="list-group-item">SUSE Linux Enterprise Server 12 SP5 LTSS</li> <li class="list-group-item">SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security</li> <li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 12 SP5</li> </ul> </td> </tr> </tbody> </table>
<p>An update that solves nine vulnerabilities can now be installed.</p>
<h2>Description:</h2> <p>This update for MozillaFirefox to 128.7esr fixes the following issues:</p> <ul> <li>MFSA 2025-09</li> <li>CVE-2025-1009 (bmo#1936613) Use-after-free in XSLT</li> <li>CVE-2025-1010 (bmo#1936982) Use-after-free in Custom Highlight</li> <li>CVE-2025-1011 (bmo#1936454) A bug in WebAssembly code generation could result in a crash</li> <li>CVE-2025-1012 (bmo#1939710) Use-after-free during concurrent delazification</li> <li>CVE-2024-11704 (bmo#1899402) Potential double-free vulnerability in PKCS#7 decryption handling</li> <li>CVE-2025-1013 (bmo#1932555) Potential opening of private browsing tabs in normal browsing windows</li> <li>CVE-2025-1014 (bmo#1940804) Certificate length was not properly checked</li> <li>CVE-2025-1016 (bmo#1936601, bmo#1936844, bmo#1937694, bmo#1938469, bmo#1939583, bmo#1940994) Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20, and Thunderbird 128.7</li> <li>CVE-2025-1017 (bmo#1926256, bmo#1935471, bmo#1935984) Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7</li> </ul>
<h2>Patch Instructions:</h2> <p> To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product: </p> <ul class="list-group"> <li class="list-group-item"> SUSE Linux Enterprise Server 12 SP5 LTSS <br/> <code>zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-2025-391=1</code> </li> <li class="list-group-item"> SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security <br/> <code>zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2025-391=1</code> </li> </ul>
<h2>Package List:</h2> <ul> <li> SUSE Linux Enterprise Server 12 SP5 LTSS (aarch64 ppc64le s390x x86_64) <ul> <li>MozillaFirefox-translations-common-128.7.0-112.246.1</li> <li>MozillaFirefox-128.7.0-112.246.1</li> <li>MozillaFirefox-debugsource-128.7.0-112.246.1</li> <li>MozillaFirefox-debuginfo-128.7.0-112.246.1</li> </ul> </li> <li> SUSE Linux Enterprise Server 12 SP5 LTSS (noarch) <ul> <li>MozillaFirefox-devel-128.7.0-112.246.1</li> </ul> </li> <li> SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (x86_64) <ul> <li>MozillaFirefox-translations-common-128.7.0-112.246.1</li> <li>MozillaFirefox-128.7.0-112.246.1</li> <li>MozillaFirefox-debugsource-128.7.0-112.246.1</li> <li>MozillaFirefox-debuginfo-128.7.0-112.246.1</li> </ul> </li> <li> SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (noarch) <ul> <li>MozillaFirefox-devel-128.7.0-112.246.1</li> </ul> </li> </ul>
<h2>References:</h2> <ul> <li> <a href="https://www.suse.com/security/cve/CVE-2024-11704.html">https://www.suse.com/security/cve/CVE-2024-11704.html</a> </li> <li> <a href="https://www.suse.com/security/cve/CVE-2025-1009.html">https://www.suse.com/security/cve/CVE-2025-1009.html</a> </li> <li> <a href="https://www.suse.com/security/cve/CVE-2025-1010.html">https://www.suse.com/security/cve/CVE-2025-1010.html</a> </li> <li> <a href="https://www.suse.com/security/cve/CVE-2025-1011.html">https://www.suse.com/security/cve/CVE-2025-1011.html</a> </li> <li> <a href="https://www.suse.com/security/cve/CVE-2025-1012.html">https://www.suse.com/security/cve/CVE-2025-1012.html</a> </li> <li> <a href="https://www.suse.com/security/cve/CVE-2025-1013.html">https://www.suse.com/security/cve/CVE-2025-1013.html</a> </li> <li> <a href="https://www.suse.com/security/cve/CVE-2025-1014.html">https://www.suse.com/security/cve/CVE-2025-1014.html</a> </li> <li> <a href="https://www.suse.com/security/cve/CVE-2025-1016.html">https://www.suse.com/security/cve/CVE-2025-1016.html</a> </li> <li> <a href="https://www.suse.com/security/cve/CVE-2025-1017.html">https://www.suse.com/security/cve/CVE-2025-1017.html</a> </li> <li> <a href="https://bugzilla.suse.com/show_bug.cgi?id=1236539">https://bugzilla.suse.com/show_bug.cgi?id=1236539</a> </li> </ul> </div>
--===============7082898455400899494==--
|