Every CVE Search/ Get API key

CVE-2025-13017

Same-origin policy bypass in the DOM: Notifications component

8.1 HighFix available

Same-origin policy bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.27%Up 0.3 points since Nov 12, 2025
90%50%10%1%

What each source reports

CVE List Score used 8.1

Same-origin policy bypass in the DOM: Notifications component

Same-origin policy bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5.

Record
CVE-2025-13017
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weakness
CWE-942
Updated
2026-11-02
EUVDEUVD-2025-84326 8.1

Same-origin policy bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5.

Record
EUVD-2025-84326
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-8prr-wp36-5mv2 8.1

Same-origin policy bypass in the DOM: Notifications component. This vulnerability affects Firefox...

Same-origin policy bypass in the DOM: Notifications component. This vulnerability affects Firefox < 145 and Firefox ESR < 140.5.

Record
GHSA-8prr-wp36-5mv2
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weakness
CWE-942
Updated
2026-11-02
NVD 8.1

Same-origin policy bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5.

Record
CVE-2025-13017
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weakness
CWE-942
Updated
2026-11-02
OSV 8.1

Same-origin policy bypass in the DOM: Notifications component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Thunderbird < 145, and Thunderbird < 140.5.

Record
CVE-2025-13017
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2025-13017 8.1

Same-origin policy bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5.

Record
DEBIAN-CVE-2025-13017
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
Show 44 moreShow less
OSVOESA-2025-2701 7.5

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global moz_debug_prefix /lib/debug %global moz_debug_dir /lib/debug/ %global uname_m %(uname -m) %global symbols_file_name -.en-US.-%(uname.crashreporter-symbols.zip %global symbols_file_path /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip %global _find_debuginfo_opts -p /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip -o debugcrashreporter.list %global crashreporter_pkg_name mozilla-crashreporter--debuginfo

Security Fix(es):

Race condition in the Graphics component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, and Firefox ESR < 115.30.(CVE-2025-13012)

Mitigation bypass in the DOM: Core & HTML component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Firefox ESR < 115.30, Thunderbird < 145, and Thunderbird < 140.5.(CVE-2025-13013)

Use-after-free in the Audio/Video component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, and Firefox ESR < 115.30.(CVE-2025-13014)

Spoofing issue in Firefox. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, and Firefox ESR < 115.30.(CVE-2025-13015)

Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 145 and Firefox ESR < 140.5.(CVE-2025-13016)

Same-origin policy bypass in the DOM: Notifications component. This vulnerability affects Firefox < 145 and Firefox ESR < 140.5.(CVE-2025-13017)

Mitigation bypass vulnerability in the DOM Security component. This vulnerability affects Firefox versions prior to 145 and Firefox ESR versions prior to 140.5, potentially allowing remote code execution.(CVE-2025-13018)

Same-origin policy bypass in the DOM: Workers component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Thunderbird < 145, and Thunderbird < 140.5.(CVE-2025-13019)

Use-after-free in the WebRTC: Audio/Video component. This vulnerability affects Firefox < 145 and Firefox ESR < 140.5. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code, affecting confidentiality, integrity, and availability.(CVE-2025-13020)

Record
OESA-2025-2701
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2025-2702 7.5

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global moz_debug_prefix /lib/debug %global moz_debug_dir /lib/debug/ %global uname_m %(uname -m) %global symbols_file_name -.en-US.-%(uname.crashreporter-symbols.zip %global symbols_file_path /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip %global _find_debuginfo_opts -p /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip -o debugcrashreporter.list %global crashreporter_pkg_name mozilla-crashreporter--debuginfo

Security Fix(es):

Race condition in the Graphics component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, and Firefox ESR < 115.30.(CVE-2025-13012)

Mitigation bypass in the DOM: Core & HTML component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Firefox ESR < 115.30, Thunderbird < 145, and Thunderbird < 140.5.(CVE-2025-13013)

Use-after-free in the Audio/Video component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, and Firefox ESR < 115.30.(CVE-2025-13014)

Spoofing issue in Firefox. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, and Firefox ESR < 115.30.(CVE-2025-13015)

Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 145 and Firefox ESR < 140.5.(CVE-2025-13016)

Same-origin policy bypass in the DOM: Notifications component. This vulnerability affects Firefox < 145 and Firefox ESR < 140.5.(CVE-2025-13017)

Mitigation bypass vulnerability in the DOM Security component. This vulnerability affects Firefox versions prior to 145 and Firefox ESR versions prior to 140.5, potentially allowing remote code execution.(CVE-2025-13018)

Same-origin policy bypass in the DOM: Workers component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Thunderbird < 145, and Thunderbird < 140.5.(CVE-2025-13019)

Use-after-free in the WebRTC: Audio/Video component. This vulnerability affects Firefox < 145 and Firefox ESR < 140.5. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code, affecting confidentiality, integrity, and availability.(CVE-2025-13020)

Record
OESA-2025-2702
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2025-2703 7.5

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global moz_debug_prefix /lib/debug %global moz_debug_dir /lib/debug/ %global uname_m %(uname -m) %global symbols_file_name -.en-US.-%(uname.crashreporter-symbols.zip %global symbols_file_path /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip %global _find_debuginfo_opts -p /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip -o debugcrashreporter.list %global crashreporter_pkg_name mozilla-crashreporter--debuginfo

Security Fix(es):

Race condition in the Graphics component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, and Firefox ESR < 115.30.(CVE-2025-13012)

Mitigation bypass in the DOM: Core & HTML component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Firefox ESR < 115.30, Thunderbird < 145, and Thunderbird < 140.5.(CVE-2025-13013)

Use-after-free in the Audio/Video component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, and Firefox ESR < 115.30.(CVE-2025-13014)

Spoofing issue in Firefox. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, and Firefox ESR < 115.30.(CVE-2025-13015)

Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 145 and Firefox ESR < 140.5.(CVE-2025-13016)

Same-origin policy bypass in the DOM: Notifications component. This vulnerability affects Firefox < 145 and Firefox ESR < 140.5.(CVE-2025-13017)

Mitigation bypass vulnerability in the DOM Security component. This vulnerability affects Firefox versions prior to 145 and Firefox ESR versions prior to 140.5, potentially allowing remote code execution.(CVE-2025-13018)

Same-origin policy bypass in the DOM: Workers component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Thunderbird < 145, and Thunderbird < 140.5.(CVE-2025-13019)

Use-after-free in the WebRTC: Audio/Video component. This vulnerability affects Firefox < 145 and Firefox ESR < 140.5. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code, affecting confidentiality, integrity, and availability.(CVE-2025-13020)

Record
OESA-2025-2703
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2025-2704 7.5

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global moz_debug_prefix /lib/debug %global moz_debug_dir /lib/debug/ %global uname_m %(uname -m) %global symbols_file_name -.en-US.-%(uname.crashreporter-symbols.zip %global symbols_file_path /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip %global _find_debuginfo_opts -p /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip -o debugcrashreporter.list %global crashreporter_pkg_name mozilla-crashreporter--debuginfo

Security Fix(es):

Race condition in the Graphics component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, and Firefox ESR < 115.30.(CVE-2025-13012)

Mitigation bypass in the DOM: Core & HTML component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Firefox ESR < 115.30, Thunderbird < 145, and Thunderbird < 140.5.(CVE-2025-13013)

Use-after-free in the Audio/Video component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, and Firefox ESR < 115.30.(CVE-2025-13014)

Spoofing issue in Firefox. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, and Firefox ESR < 115.30.(CVE-2025-13015)

Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 145 and Firefox ESR < 140.5.(CVE-2025-13016)

Same-origin policy bypass in the DOM: Notifications component. This vulnerability affects Firefox < 145 and Firefox ESR < 140.5.(CVE-2025-13017)

Mitigation bypass vulnerability in the DOM Security component. This vulnerability affects Firefox versions prior to 145 and Firefox ESR versions prior to 140.5, potentially allowing remote code execution.(CVE-2025-13018)

Same-origin policy bypass in the DOM: Workers component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Thunderbird < 145, and Thunderbird < 140.5.(CVE-2025-13019)

Use-after-free in the WebRTC: Audio/Video component. This vulnerability affects Firefox < 145 and Firefox ESR < 140.5. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code, affecting confidentiality, integrity, and availability.(CVE-2025-13020)

Record
OESA-2025-2704
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2025-2705 7.5

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global moz_debug_prefix /lib/debug %global moz_debug_dir /lib/debug/ %global uname_m %(uname -m) %global symbols_file_name -.en-US.-%(uname.crashreporter-symbols.zip %global symbols_file_path /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip %global _find_debuginfo_opts -p /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip -o debugcrashreporter.list %global crashreporter_pkg_name mozilla-crashreporter--debuginfo

Security Fix(es):

Race condition in the Graphics component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, and Firefox ESR < 115.30.(CVE-2025-13012)

Mitigation bypass in the DOM: Core & HTML component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Firefox ESR < 115.30, Thunderbird < 145, and Thunderbird < 140.5.(CVE-2025-13013)

Use-after-free in the Audio/Video component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, and Firefox ESR < 115.30.(CVE-2025-13014)

Spoofing issue in Firefox. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, and Firefox ESR < 115.30.(CVE-2025-13015)

Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 145 and Firefox ESR < 140.5.(CVE-2025-13016)

Same-origin policy bypass in the DOM: Notifications component. This vulnerability affects Firefox < 145 and Firefox ESR < 140.5.(CVE-2025-13017)

Mitigation bypass vulnerability in the DOM Security component. This vulnerability affects Firefox versions prior to 145 and Firefox ESR versions prior to 140.5, potentially allowing remote code execution.(CVE-2025-13018)

Same-origin policy bypass in the DOM: Workers component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Thunderbird < 145, and Thunderbird < 140.5.(CVE-2025-13019)

Use-after-free in the WebRTC: Audio/Video component. This vulnerability affects Firefox < 145 and Firefox ESR < 140.5. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code, affecting confidentiality, integrity, and availability.(CVE-2025-13020)

Record
OESA-2025-2705
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2025-2770 8.8

thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

Race condition in the Graphics component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Firefox ESR < 115.30, Thunderbird < 145, and Thunderbird < 140.5.(CVE-2025-13012)

Mitigation bypass in the DOM: Core & HTML component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, and Firefox ESR < 115.30.(CVE-2025-13013)

Use-after-free in the Audio/Video component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, and Firefox ESR < 115.30.(CVE-2025-13014)

Spoofing issue in Firefox. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, and Firefox ESR < 115.30.(CVE-2025-13015)

Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 145 and Firefox ESR < 140.5.(CVE-2025-13016)

Same-origin policy bypass in the DOM: Notifications component. This vulnerability affects Firefox < 145 and Firefox ESR < 140.5.(CVE-2025-13017)

Mitigation bypass vulnerability in the DOM Security component. This vulnerability affects Firefox versions prior to 145 and Firefox ESR versions prior to 140.5, potentially allowing remote code execution.(CVE-2025-13018)

Same-origin policy bypass in the DOM: Workers component. This vulnerability affects Firefox < 145 and Firefox ESR < 140.5.(CVE-2025-13019)

Use-after-free in the WebRTC: Audio/Video component. This vulnerability affects Firefox < 145 and Firefox ESR < 140.5. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code, affecting confidentiality, integrity, and availability.(CVE-2025-13020)

Record
OESA-2025-2770
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:21120 7.5

Red Hat Security Advisory: firefox security update

Record
RHSA-2025:21120
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:21121 7.5

Red Hat Security Advisory: firefox security update

Record
RHSA-2025:21121
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:21280 7.5

Red Hat Security Advisory: firefox security update

Record
RHSA-2025:21280
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:21281 7.5

Red Hat Security Advisory: firefox security update

Record
RHSA-2025:21281
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:21841 7.5

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2025:21841
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:21842 7.5

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2025:21842
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:21843 7.5

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2025:21843
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:21844 7.5

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2025:21844
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:21881 7.5

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2025:21881
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:22363 7.5

Red Hat Security Advisory: firefox security update

Record
RHSA-2025:22363
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:22367 7.5

Red Hat Security Advisory: firefox security update

Record
RHSA-2025:22367
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:22368 7.5

Red Hat Security Advisory: firefox security update

Record
RHSA-2025:22368
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:22369 7.5

Red Hat Security Advisory: firefox security update

Record
RHSA-2025:22369
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:22371 7.5

Red Hat Security Advisory: firefox security update

Record
RHSA-2025:22371
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:22372 7.5

Red Hat Security Advisory: firefox security update

Record
RHSA-2025:22372
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:22373 7.5

Red Hat Security Advisory: firefox security update

Record
RHSA-2025:22373
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:22374 7.5

Red Hat Security Advisory: firefox security update

Record
RHSA-2025:22374
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:22375 7.5

Red Hat Security Advisory: firefox security update

Record
RHSA-2025:22375
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:22449 7.5

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2025:22449
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:22450 7.5

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2025:22450
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:22451 7.5

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2025:22451
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:22791 7.5

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2025:22791
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:22792 7.5

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2025:22792
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:22882 7.5

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2025:22882
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:22883 7.5

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2025:22883
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2025:21280 7.5

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

  • firefox: Mitigation bypass in the DOM: Security component (CVE-2025-13018)

  • firefox: Use-after-free in the Audio/Video component (CVE-2025-13014)

  • firefox: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2025-13016)

  • firefox: Same-origin policy bypass in the DOM: Workers component (CVE-2025-13019)

  • firefox: Use-after-free in the WebRTC: Audio/Video component (CVE-2025-13020)

  • firefox: Race condition in the Graphics component (CVE-2025-13012)

  • firefox: Spoofing issue in Firefox (CVE-2025-13015)

  • firefox: Mitigation bypass in the DOM: Core & HTML component (CVE-2025-13013)

  • firefox: Same-origin policy bypass in the DOM: Notifications component (CVE-2025-13017)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:21280
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2025:21281 7.5

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

  • firefox: Mitigation bypass in the DOM: Security component (CVE-2025-13018)

  • firefox: Use-after-free in the Audio/Video component (CVE-2025-13014)

  • firefox: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2025-13016)

  • firefox: Same-origin policy bypass in the DOM: Workers component (CVE-2025-13019)

  • firefox: Use-after-free in the WebRTC: Audio/Video component (CVE-2025-13020)

  • firefox: Race condition in the Graphics component (CVE-2025-13012)

  • firefox: Spoofing issue in Firefox (CVE-2025-13015)

  • firefox: Mitigation bypass in the DOM: Core & HTML component (CVE-2025-13013)

  • firefox: Same-origin policy bypass in the DOM: Notifications component (CVE-2025-13017)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:21281
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2025:21843 7.5

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

  • firefox: Mitigation bypass in the DOM: Security component (CVE-2025-13018)

  • firefox: Use-after-free in the Audio/Video component (CVE-2025-13014)

  • firefox: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2025-13016)

  • firefox: Same-origin policy bypass in the DOM: Workers component (CVE-2025-13019)

  • firefox: Use-after-free in the WebRTC: Audio/Video component (CVE-2025-13020)

  • firefox: Race condition in the Graphics component (CVE-2025-13012)

  • firefox: Spoofing issue in Firefox (CVE-2025-13015)

  • firefox: Mitigation bypass in the DOM: Core & HTML component (CVE-2025-13013)

  • firefox: Same-origin policy bypass in the DOM: Notifications component (CVE-2025-13017)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:21843
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2025:21881 7.5

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

  • firefox: Mitigation bypass in the DOM: Security component (CVE-2025-13018)

  • firefox: Use-after-free in the Audio/Video component (CVE-2025-13014)

  • firefox: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2025-13016)

  • firefox: Same-origin policy bypass in the DOM: Workers component (CVE-2025-13019)

  • firefox: Use-after-free in the WebRTC: Audio/Video component (CVE-2025-13020)

  • firefox: Race condition in the Graphics component (CVE-2025-13012)

  • firefox: Spoofing issue in Firefox (CVE-2025-13015)

  • firefox: Mitigation bypass in the DOM: Core & HTML component (CVE-2025-13013)

  • firefox: Same-origin policy bypass in the DOM: Notifications component (CVE-2025-13017)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:21881
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2025:22363 7.5

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

  • firefox: Mitigation bypass in the DOM: Security component (CVE-2025-13018)

  • firefox: Use-after-free in the Audio/Video component (CVE-2025-13014)

  • firefox: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2025-13016)

  • firefox: Same-origin policy bypass in the DOM: Workers component (CVE-2025-13019)

  • firefox: Use-after-free in the WebRTC: Audio/Video component (CVE-2025-13020)

  • firefox: Race condition in the Graphics component (CVE-2025-13012)

  • firefox: Spoofing issue in Firefox (CVE-2025-13015)

  • firefox: Mitigation bypass in the DOM: Core & HTML component (CVE-2025-13013)

  • firefox: Same-origin policy bypass in the DOM: Notifications component (CVE-2025-13017)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:22363
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-13017 8.1

Same-origin policy bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5.

Record
UBUNTU-CVE-2025-13017
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVALSA-2025:21280 No score

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

  • firefox: Mitigation bypass in the DOM: Security component (CVE-2025-13018)
  • firefox: Use-after-free in the Audio/Video component (CVE-2025-13014)
  • firefox: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2025-13016)
  • firefox: Same-origin policy bypass in the DOM: Workers component (CVE-2025-13019)
  • firefox: Use-after-free in the WebRTC: Audio/Video component (CVE-2025-13020)
  • firefox: Race condition in the Graphics component (CVE-2025-13012)
  • firefox: Spoofing issue in Firefox (CVE-2025-13015)
  • firefox: Mitigation bypass in the DOM: Core & HTML component (CVE-2025-13013)
  • firefox: Same-origin policy bypass in the DOM: Notifications component (CVE-2025-13017)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:21280
Updated
2026-11-02
OSVALSA-2025:21281 No score

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

  • firefox: Mitigation bypass in the DOM: Security component (CVE-2025-13018)
  • firefox: Use-after-free in the Audio/Video component (CVE-2025-13014)
  • firefox: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2025-13016)
  • firefox: Same-origin policy bypass in the DOM: Workers component (CVE-2025-13019)
  • firefox: Use-after-free in the WebRTC: Audio/Video component (CVE-2025-13020)
  • firefox: Race condition in the Graphics component (CVE-2025-13012)
  • firefox: Spoofing issue in Firefox (CVE-2025-13015)
  • firefox: Mitigation bypass in the DOM: Core & HTML component (CVE-2025-13013)
  • firefox: Same-origin policy bypass in the DOM: Notifications component (CVE-2025-13017)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:21281
Updated
2026-11-02
OSVALSA-2025:21843 No score

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

  • firefox: Mitigation bypass in the DOM: Security component (CVE-2025-13018)
  • firefox: Use-after-free in the Audio/Video component (CVE-2025-13014)
  • firefox: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2025-13016)
  • firefox: Same-origin policy bypass in the DOM: Workers component (CVE-2025-13019)
  • firefox: Use-after-free in the WebRTC: Audio/Video component (CVE-2025-13020)
  • firefox: Race condition in the Graphics component (CVE-2025-13012)
  • firefox: Spoofing issue in Firefox (CVE-2025-13015)
  • firefox: Mitigation bypass in the DOM: Core & HTML component (CVE-2025-13013)
  • firefox: Same-origin policy bypass in the DOM: Notifications component (CVE-2025-13017)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:21843
Updated
2026-11-02
OSVALSA-2025:21881 No score

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

  • firefox: Mitigation bypass in the DOM: Security component (CVE-2025-13018)
  • firefox: Use-after-free in the Audio/Video component (CVE-2025-13014)
  • firefox: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2025-13016)
  • firefox: Same-origin policy bypass in the DOM: Workers component (CVE-2025-13019)
  • firefox: Use-after-free in the WebRTC: Audio/Video component (CVE-2025-13020)
  • firefox: Race condition in the Graphics component (CVE-2025-13012)
  • firefox: Spoofing issue in Firefox (CVE-2025-13015)
  • firefox: Mitigation bypass in the DOM: Core & HTML component (CVE-2025-13013)
  • firefox: Same-origin policy bypass in the DOM: Notifications component (CVE-2025-13017)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:21881
Updated
2026-11-02
OSVALSA-2025:22363 No score

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

  • firefox: Mitigation bypass in the DOM: Security component (CVE-2025-13018)
  • firefox: Use-after-free in the Audio/Video component (CVE-2025-13014)
  • firefox: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2025-13016)
  • firefox: Same-origin policy bypass in the DOM: Workers component (CVE-2025-13019)
  • firefox: Use-after-free in the WebRTC: Audio/Video component (CVE-2025-13020)
  • firefox: Race condition in the Graphics component (CVE-2025-13012)
  • firefox: Spoofing issue in Firefox (CVE-2025-13015)
  • firefox: Mitigation bypass in the DOM: Core & HTML component (CVE-2025-13013)
  • firefox: Same-origin policy bypass in the DOM: Notifications component (CVE-2025-13017)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:22363
Updated
2026-11-02
OSVMGASA-2025-0300 No score

Updated firefox packages fix security vulnerabilities

Race condition in the Graphics component. (CVE-2025-13012) Mitigation bypass in the DOM: Core & HTML component. (CVE-2025-13013) CVE-2025-13014: Use-after-free in the Audio/Video component. (CVE-2025-13014) Spoofing issue in Firefox. (CVE-2025-13015) Incorrect boundary conditions in the JavaScript: WebAssembly component. (CVE-2025-13016) Same-origin policy bypass in the DOM: Notifications component. (CVE-2025-13017) Mitigation bypass in the DOM: Security component. (CVE-2025-13018) Same-origin policy bypass in the DOM: Workers component. (CVE-2025-13019) Use-after-free in the WebRTC: Audio/Video component. (CVE-2025-13020)

Record
MGASA-2025-0300
Updated
2026-11-02
OSVMGASA-2025-0305 No score

Updated thunderbird packages fix security vulnerabilities

Race condition in the Graphics component. (CVE-2025-13012) Mitigation bypass in the DOM: Core & HTML component. (CVE-2025-13013) CVE-2025-13014: Use-after-free in the Audio/Video component. (CVE-2025-13014) Spoofing issue in Firefox. (CVE-2025-13015) Incorrect boundary conditions in the JavaScript: WebAssembly component. (CVE-2025-13016) Same-origin policy bypass in the DOM: Notifications component. (CVE-2025-13017) Mitigation bypass in the DOM: Security component. (CVE-2025-13018) Same-origin policy bypass in the DOM: Workers component. (CVE-2025-13019) Use-after-free in the WebRTC: Audio/Video component. (CVE-2025-13020)

Record
MGASA-2025-0305
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
firefox
AlmaLinux:9
From an advisory covering 9 CVEs
 before 140.5.0-1.el9_7.alma.1
140.5.0-1.el9_7.alma.1
firefox-x11
AlmaLinux:9
From an advisory covering 9 CVEs
 before 140.5.0-1.el9_7.alma.1
140.5.0-1.el9_7.alma.1
firefox
AlmaLinux:10
From an advisory covering 9 CVEs
 before 140.5.0-2.el10_1
140.5.0-2.el10_1
thunderbird
AlmaLinux:10
From an advisory covering 9 CVEs
 before 140.5.0-2.el10_1
140.5.0-2.el10_1
thunderbird
AlmaLinux:8
From an advisory covering 9 CVEs
 before 140.5.0-2.el8_10.alma.1
140.5.0-2.el8_10.alma.1
firefox
AlmaLinux:8
From an advisory covering 9 CVEs
 before 140.5.0-1.el8_10.alma.1
140.5.0-1.el8_10.alma.1
firefox-esr
Debian:12
 before 140.5.0esr-1~deb12u1, plus listed versions
102.11.0esr-1102.12.0esr-1102.12.0esr-1~deb10u1102.12.0esr-1~deb11u1102.12.0esr-1~deb12u1
Show 45 moreShow less
102.13.0esr-1102.13.0esr-1~deb10u1102.13.0esr-1~deb11u1102.13.0esr-1~deb12u1102.14.0esr-1~deb10u1102.14.0esr-1~deb11u1102.14.0esr-1~deb12u1102.15.0esr-1~deb10u1102.15.0esr-1~deb11u1102.15.0esr-1~deb12u1102.15.1esr-1~deb10u1102.15.1esr-1~deb11u1102.15.1esr-1~deb12u1115.0.2esr-1115.1.0esr-1115.10.0esr-1115.10.0esr-1~deb10u1115.10.0esr-1~deb11u1115.10.0esr-1~deb12u1115.11.0esr-1115.11.0esr-1~deb10u1115.11.0esr-1~deb11u1115.11.0esr-1~deb12u1115.12.0esr-1115.12.0esr-1~deb10u1115.12.0esr-1~deb11u1115.12.0esr-1~deb12u1115.13.0esr-1115.13.0esr-1~deb11u1115.13.0esr-1~deb12u1115.13.0esr-2115.14.0esr-1115.14.0esr-1~deb11u1115.14.0esr-1~deb12u1115.15.0esr-1115.15.0esr-1~deb11u1115.15.0esr-1~deb12u1115.2.0esr-1115.2.1esr-1115.3.0esr-1115.3.0esr-1~deb10u1115.3.0esr-1~deb11u1115.3.0esr-1~deb12u1115.3.1esr-1~deb10u1115.3.1esr-1~deb11u1
140.5.0esr-1~deb12u1
firefox-esr
Debian:13
 before 140.5.0esr-1~deb13u1, plus listed versions
128.13.0esr-1128.14.0esr-1128.14.0esr-1~deb11u1128.14.0esr-1~deb12u1128.14.0esr-1~deb13u1
Show 17 moreShow less
140.3.0esr-1140.3.0esr-1~deb11u1140.3.0esr-1~deb11u2140.3.0esr-1~deb12u1140.3.0esr-1~deb13u1140.3.0esr-2140.3.1esr-1140.3.1esr-1~deb11u1140.3.1esr-1~deb12u1140.3.1esr-1~deb13u1140.3.1esr-2140.4.0esr-1140.4.0esr-1~deb11u1140.4.0esr-1~deb12u1140.4.0esr-1~deb13u1140.5.0esr-1~deb11u1140.5.0esr-1~deb12u1
140.5.0esr-1~deb13u1
firefox-esr
Debian:14
 before 140.5.0esr-1, plus listed versions
128.13.0esr-1128.14.0esr-1128.14.0esr-1~deb11u1128.14.0esr-1~deb12u1128.14.0esr-1~deb13u1
Show 18 moreShow less
140.3.0esr-1140.3.0esr-1~deb11u1140.3.0esr-1~deb11u2140.3.0esr-1~deb12u1140.3.0esr-1~deb13u1140.3.0esr-2140.3.1esr-1140.3.1esr-1~deb11u1140.3.1esr-1~deb12u1140.3.1esr-1~deb13u1140.3.1esr-2140.4.0esr-1140.4.0esr-1~deb11u1140.4.0esr-1~deb12u1140.4.0esr-1~deb13u1140.5.0esr-1~deb11u1140.5.0esr-1~deb12u1140.5.0esr-1~deb13u1
140.5.0esr-1
thunderbird
Debian:12
 before 1:140.5.0esr-1~deb12u1, plus listed versions
1:102.11.0-11:102.12.0-11:102.12.0-1~deb10u11:102.12.0-1~deb11u11:102.12.0-1~deb12u1
Show 45 moreShow less
1:102.13.0-11:102.13.0-1~deb10u11:102.13.0-1~deb11u11:102.13.0-1~deb12u11:102.13.1-11:102.13.1-1~deb10u11:102.13.1-1~deb11u11:102.13.1-1~deb12u11:102.14.0-1~deb10u11:102.14.0-1~deb11u11:102.14.0-1~deb12u11:102.15.0-1~deb10u11:102.15.0-1~deb11u11:102.15.0-1~deb12u11:102.15.1-1~deb10u11:102.15.1-1~deb11u11:102.15.1-1~deb12u11:103.0~b5-11:104.0~b2-11:110.0~b4-11:112.0~b1-11:113.0~b3-11:114.0~b2-11:115.0-11:115.0.1-11:115.0.1-21:115.0~b4-11:115.0~b6-11:115.1.0-11:115.1.1-11:115.10.1-11:115.10.1-1~deb10u11:115.10.1-1~deb11u11:115.10.1-1~deb12u11:115.11.0-11:115.11.0-1~deb10u11:115.11.0-1~deb11u11:115.11.0-1~deb12u11:115.12.0-11:115.12.0-1~deb10u11:115.12.0-1~deb11u11:115.12.0-1~deb12u11:115.13.0-11:115.13.0-1~deb11u11:115.13.0-1~deb12u1
1:140.5.0esr-1~deb12u1
Show 164 moreShow less
Affected packages
PackageAffectedFixed
thunderbird
Debian:13
 before 1:140.5.0esr-1~deb13u1, plus listed versions
1:128.13.0esr-11:128.14.0esr-11:128.14.0esr-1~deb11u11:128.14.0esr-1~deb12u11:128.14.0esr-1~deb13u1
Show 22 moreShow less
1:129.0~b6-11:130.0~b3-11:132.0~b6-11:135.0-11:136.0-11:137.0-11:138.0-11:140.0.1esr-11:140.1.0esr-11:140.1.1esr-11:140.2.0esr-11:140.3.0esr-11:140.3.0esr-1~deb11u11:140.3.0esr-1~deb12u11:140.3.0esr-1~deb13u11:140.3.1esr-11:140.4.0esr-11:140.4.0esr-1~deb11u11:140.4.0esr-1~deb12u11:140.4.0esr-1~deb13u11:140.5.0esr-1~deb11u11:140.5.0esr-1~deb12u1
1:140.5.0esr-1~deb13u1
thunderbird
Debian:14
 before 1:140.5.0esr-1, plus listed versions
1:128.13.0esr-11:128.14.0esr-11:128.14.0esr-1~deb11u11:128.14.0esr-1~deb12u11:128.14.0esr-1~deb13u1
Show 23 moreShow less
1:129.0~b6-11:130.0~b3-11:132.0~b6-11:135.0-11:136.0-11:137.0-11:138.0-11:140.0.1esr-11:140.1.0esr-11:140.1.1esr-11:140.2.0esr-11:140.3.0esr-11:140.3.0esr-1~deb11u11:140.3.0esr-1~deb12u11:140.3.0esr-1~deb13u11:140.3.1esr-11:140.4.0esr-11:140.4.0esr-1~deb11u11:140.4.0esr-1~deb12u11:140.4.0esr-1~deb13u11:140.5.0esr-1~deb11u11:140.5.0esr-1~deb12u11:140.5.0esr-1~deb13u1
1:140.5.0esr-1
firefox-esr
Debian:11
From an advisory covering 9 CVEs
 before 140.5.0esr-1~deb11u1, plus listed versions
102.1.0esr-1102.1.0esr-2102.10.0esr-1102.10.0esr-1~deb10u1102.10.0esr-1~deb11u1
Show 45 moreShow less
102.11.0esr-1102.11.0esr-1~deb10u1102.11.0esr-1~deb11u1102.12.0esr-1102.12.0esr-1~deb10u1102.12.0esr-1~deb11u1102.12.0esr-1~deb12u1102.13.0esr-1102.13.0esr-1~deb10u1102.13.0esr-1~deb11u1102.13.0esr-1~deb12u1102.14.0esr-1~deb10u1102.14.0esr-1~deb11u1102.14.0esr-1~deb12u1102.15.0esr-1~deb10u1102.15.0esr-1~deb11u1102.15.0esr-1~deb12u1102.15.1esr-1~deb10u1102.15.1esr-1~deb11u1102.15.1esr-1~deb12u1102.2.0esr-1102.3.0esr-1102.3.0esr-1~deb10u1102.3.0esr-1~deb10u2102.3.0esr-1~deb11u1102.4.0esr-1102.4.0esr-1~deb10u1102.4.0esr-1~deb11u1102.5.0esr-1102.5.0esr-1~deb10u1102.5.0esr-1~deb11u1102.6.0esr-1102.6.0esr-1~deb10u1102.6.0esr-1~deb11u1102.7.0esr-1102.7.0esr-1~deb10u1102.7.0esr-1~deb11u1102.8.0esr-1102.8.0esr-1~deb10u1102.8.0esr-1~deb11u1102.9.0esr-1102.9.0esr-1~deb10u1102.9.0esr-1~deb11u1102.9.0esr-2115.0.2esr-1
140.5.0esr-1~deb11u1
thunderbird
Debian:11
From an advisory covering 9 CVEs
 before 1:140.5.0esr-1~deb11u1, plus listed versions
1:102.0.1-11:102.0.2-11:102.0~b4-11:102.0~b7-11:102.1.0-1
Show 45 moreShow less
1:102.1.1-11:102.1.2-11:102.10.0-11:102.10.0-1~deb10u11:102.10.0-1~deb11u11:102.11.0-11:102.11.0-1~deb10u11:102.11.0-1~deb11u11:102.12.0-11:102.12.0-1~deb10u11:102.12.0-1~deb11u11:102.12.0-1~deb12u11:102.13.0-11:102.13.0-1~deb10u11:102.13.0-1~deb11u11:102.13.0-1~deb12u11:102.13.1-11:102.13.1-1~deb10u11:102.13.1-1~deb11u11:102.13.1-1~deb12u11:102.14.0-1~deb10u11:102.14.0-1~deb11u11:102.14.0-1~deb12u11:102.15.0-1~deb10u11:102.15.0-1~deb11u11:102.15.0-1~deb12u11:102.15.1-1~deb10u11:102.15.1-1~deb11u11:102.15.1-1~deb12u11:102.2.0-11:102.2.1-11:102.2.2-11:102.3.0-11:102.3.0-1~deb10u11:102.3.0-1~deb11u11:102.3.1-11:102.3.2-11:102.3.3-11:102.4.0-11:102.4.0-1~deb10u11:102.4.0-1~deb11u11:102.4.1-11:102.5.0-11:102.5.0-1~deb10u11:102.5.0-1~deb11u1
1:140.5.0esr-1~deb11u1
firefox-esr
Debian:12
From an advisory covering 9 CVEs
 before 140.5.0esr-1~deb12u1, plus listed versions
102.11.0esr-1102.12.0esr-1102.12.0esr-1~deb10u1102.12.0esr-1~deb11u1102.12.0esr-1~deb12u1
Show 45 moreShow less
102.13.0esr-1102.13.0esr-1~deb10u1102.13.0esr-1~deb11u1102.13.0esr-1~deb12u1102.14.0esr-1~deb10u1102.14.0esr-1~deb11u1102.14.0esr-1~deb12u1102.15.0esr-1~deb10u1102.15.0esr-1~deb11u1102.15.0esr-1~deb12u1102.15.1esr-1~deb10u1102.15.1esr-1~deb11u1102.15.1esr-1~deb12u1115.0.2esr-1115.1.0esr-1115.10.0esr-1115.10.0esr-1~deb10u1115.10.0esr-1~deb11u1115.10.0esr-1~deb12u1115.11.0esr-1115.11.0esr-1~deb10u1115.11.0esr-1~deb11u1115.11.0esr-1~deb12u1115.12.0esr-1115.12.0esr-1~deb10u1115.12.0esr-1~deb11u1115.12.0esr-1~deb12u1115.13.0esr-1115.13.0esr-1~deb11u1115.13.0esr-1~deb12u1115.13.0esr-2115.14.0esr-1115.14.0esr-1~deb11u1115.14.0esr-1~deb12u1115.15.0esr-1115.15.0esr-1~deb11u1115.15.0esr-1~deb12u1115.2.0esr-1115.2.1esr-1115.3.0esr-1115.3.0esr-1~deb10u1115.3.0esr-1~deb11u1115.3.0esr-1~deb12u1115.3.1esr-1~deb10u1115.3.1esr-1~deb11u1
140.5.0esr-1~deb12u1
firefox-esr
Debian:13
From an advisory covering 9 CVEs
 before 140.5.0esr-1~deb13u1, plus listed versions
128.13.0esr-1128.14.0esr-1128.14.0esr-1~deb11u1128.14.0esr-1~deb12u1128.14.0esr-1~deb13u1
Show 17 moreShow less
140.3.0esr-1140.3.0esr-1~deb11u1140.3.0esr-1~deb11u2140.3.0esr-1~deb12u1140.3.0esr-1~deb13u1140.3.0esr-2140.3.1esr-1140.3.1esr-1~deb11u1140.3.1esr-1~deb12u1140.3.1esr-1~deb13u1140.3.1esr-2140.4.0esr-1140.4.0esr-1~deb11u1140.4.0esr-1~deb12u1140.4.0esr-1~deb13u1140.5.0esr-1~deb11u1140.5.0esr-1~deb12u1
140.5.0esr-1~deb13u1
thunderbird
Debian:12
From an advisory covering 9 CVEs
 before 1:140.5.0esr-1~deb12u1, plus listed versions
1:102.11.0-11:102.12.0-11:102.12.0-1~deb10u11:102.12.0-1~deb11u11:102.12.0-1~deb12u1
Show 45 moreShow less
1:102.13.0-11:102.13.0-1~deb10u11:102.13.0-1~deb11u11:102.13.0-1~deb12u11:102.13.1-11:102.13.1-1~deb10u11:102.13.1-1~deb11u11:102.13.1-1~deb12u11:102.14.0-1~deb10u11:102.14.0-1~deb11u11:102.14.0-1~deb12u11:102.15.0-1~deb10u11:102.15.0-1~deb11u11:102.15.0-1~deb12u11:102.15.1-1~deb10u11:102.15.1-1~deb11u11:102.15.1-1~deb12u11:103.0~b5-11:104.0~b2-11:110.0~b4-11:112.0~b1-11:113.0~b3-11:114.0~b2-11:115.0-11:115.0.1-11:115.0.1-21:115.0~b4-11:115.0~b6-11:115.1.0-11:115.1.1-11:115.10.1-11:115.10.1-1~deb10u11:115.10.1-1~deb11u11:115.10.1-1~deb12u11:115.11.0-11:115.11.0-1~deb10u11:115.11.0-1~deb11u11:115.11.0-1~deb12u11:115.12.0-11:115.12.0-1~deb10u11:115.12.0-1~deb11u11:115.12.0-1~deb12u11:115.13.0-11:115.13.0-1~deb11u11:115.13.0-1~deb12u1
1:140.5.0esr-1~deb12u1
thunderbird
Debian:13
From an advisory covering 9 CVEs
 before 1:140.5.0esr-1~deb13u1, plus listed versions
1:128.13.0esr-11:128.14.0esr-11:128.14.0esr-1~deb11u11:128.14.0esr-1~deb12u11:128.14.0esr-1~deb13u1
Show 22 moreShow less
1:129.0~b6-11:130.0~b3-11:132.0~b6-11:135.0-11:136.0-11:137.0-11:138.0-11:140.0.1esr-11:140.1.0esr-11:140.1.1esr-11:140.2.0esr-11:140.3.0esr-11:140.3.0esr-1~deb11u11:140.3.0esr-1~deb12u11:140.3.0esr-1~deb13u11:140.3.1esr-11:140.4.0esr-11:140.4.0esr-1~deb11u11:140.4.0esr-1~deb12u11:140.4.0esr-1~deb13u11:140.5.0esr-1~deb11u11:140.5.0esr-1~deb12u1
1:140.5.0esr-1~deb13u1
firefox
Mageia:9
From an advisory covering 9 CVEs
 before 140.5.0-1.mga9
140.5.0-1.mga9
firefox-l10n
Mageia:9
From an advisory covering 9 CVEs
 before 140.5.0-1.mga9
140.5.0-1.mga9
thunderbird
Mageia:9
From an advisory covering 9 CVEs
 before 140.5.0-1.mga9
140.5.0-1.mga9
thunderbird-l10n
Mageia:9
From an advisory covering 9 CVEs
 before 140.5.0-1.mga9
140.5.0-1.mga9
firefox
openEuler:22.03-LTS-SP3
From an advisory covering 9 CVEs
 before 140.5.0-1.oe2203sp3
140.5.0-1.oe2203sp3
firefox
openEuler:22.03-LTS-SP4
From an advisory covering 9 CVEs
 before 140.5.0-1.oe2203sp4
140.5.0-1.oe2203sp4
firefox
openEuler:24.03-LTS
From an advisory covering 9 CVEs
 before 140.5.0-1.oe2403
140.5.0-1.oe2403
firefox
openEuler:24.03-LTS-SP1
From an advisory covering 9 CVEs
 before 140.5.0-1.oe2403sp1
140.5.0-1.oe2403sp1
firefox
openEuler:24.03-LTS-SP2
From an advisory covering 9 CVEs
 before 140.5.0-1.oe2403sp2
140.5.0-1.oe2403sp2
thunderbird
openEuler:24.03-LTS-SP2
From an advisory covering 9 CVEs
 before 140.5.0-1.oe2403sp2
140.5.0-1.oe2403sp2
firefox
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 9 CVEs
 before 0:140.5.0-2.el10_0
0:140.5.0-2.el10_0
firefox-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 9 CVEs
 before 0:140.5.0-2.el10_0
0:140.5.0-2.el10_0
firefox-debugsource
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 9 CVEs
 before 0:140.5.0-2.el10_0
0:140.5.0-2.el10_0
firefox
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el9_6
0:140.5.0-1.el9_6
firefox-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el9_6
0:140.5.0-1.el9_6
firefox-debugsource
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el9_6
0:140.5.0-1.el9_6
firefox-x11
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el9_6
0:140.5.0-1.el9_6
firefox
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el9_7
0:140.5.0-1.el9_7
firefox-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el9_7
0:140.5.0-1.el9_7
firefox-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el9_7
0:140.5.0-1.el9_7
firefox-x11
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el9_7
0:140.5.0-1.el9_7
firefox
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 0:140.5.0-2.el10_1
0:140.5.0-2.el10_1
firefox-debuginfo
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 0:140.5.0-2.el10_1
0:140.5.0-2.el10_1
firefox-debugsource
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 0:140.5.0-2.el10_1
0:140.5.0-2.el10_1
thunderbird
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el9_6
0:140.5.0-1.el9_6
thunderbird-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el9_6
0:140.5.0-1.el9_6
thunderbird-debugsource
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el9_6
0:140.5.0-1.el9_6
thunderbird
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el9_7
0:140.5.0-1.el9_7
thunderbird-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el9_7
0:140.5.0-1.el9_7
thunderbird-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el9_7
0:140.5.0-1.el9_7
thunderbird
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 0:140.5.0-2.el10_1
0:140.5.0-2.el10_1
thunderbird-debuginfo
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 0:140.5.0-2.el10_1
0:140.5.0-2.el10_1
thunderbird-debugsource
Red Hat:enterprise_linux:10.1
From an advisory covering 9 CVEs
 before 0:140.5.0-2.el10_1
0:140.5.0-2.el10_1
thunderbird
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el10_0
0:140.5.0-1.el10_0
thunderbird-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el10_0
0:140.5.0-1.el10_0
thunderbird-debugsource
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el10_0
0:140.5.0-1.el10_0
thunderbird
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-2.el8_10
0:140.5.0-2.el8_10
thunderbird-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-2.el8_10
0:140.5.0-2.el8_10
thunderbird-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-2.el8_10
0:140.5.0-2.el8_10
firefox
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_10
0:140.5.0-1.el8_10
firefox-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_10
0:140.5.0-1.el8_10
firefox-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_10
0:140.5.0-1.el8_10
firefox
Red Hat:rhel_aus:8.4::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_4
0:140.5.0-1.el8_4
firefox-debuginfo
Red Hat:rhel_aus:8.4::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_4
0:140.5.0-1.el8_4
firefox-debugsource
Red Hat:rhel_aus:8.4::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_4
0:140.5.0-1.el8_4
firefox
Red Hat:rhel_eus_long_life:8.4::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_4
0:140.5.0-1.el8_4
firefox-debuginfo
Red Hat:rhel_eus_long_life:8.4::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_4
0:140.5.0-1.el8_4
firefox-debugsource
Red Hat:rhel_eus_long_life:8.4::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_4
0:140.5.0-1.el8_4
firefox
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_6
0:140.5.0-1.el8_6
firefox-debuginfo
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_6
0:140.5.0-1.el8_6
firefox-debugsource
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_6
0:140.5.0-1.el8_6
firefox
Red Hat:rhel_e4s:8.6::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_6
0:140.5.0-1.el8_6
firefox-debuginfo
Red Hat:rhel_e4s:8.6::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_6
0:140.5.0-1.el8_6
firefox-debugsource
Red Hat:rhel_e4s:8.6::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_6
0:140.5.0-1.el8_6
firefox
Red Hat:rhel_tus:8.6::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_6
0:140.5.0-1.el8_6
firefox-debuginfo
Red Hat:rhel_tus:8.6::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_6
0:140.5.0-1.el8_6
firefox-debugsource
Red Hat:rhel_tus:8.6::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_6
0:140.5.0-1.el8_6
firefox
Red Hat:rhel_aus:8.2::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_2
0:140.5.0-1.el8_2
firefox-debuginfo
Red Hat:rhel_aus:8.2::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_2
0:140.5.0-1.el8_2
firefox-debugsource
Red Hat:rhel_aus:8.2::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_2
0:140.5.0-1.el8_2
firefox
Red Hat:rhel_els:7
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el7_9
0:140.5.0-1.el7_9
firefox-debuginfo
Red Hat:rhel_els:7
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el7_9
0:140.5.0-1.el7_9
firefox
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_8
0:140.5.0-1.el8_8
firefox-debuginfo
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_8
0:140.5.0-1.el8_8
firefox-debugsource
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_8
0:140.5.0-1.el8_8
firefox
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_8
0:140.5.0-1.el8_8
firefox-debuginfo
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_8
0:140.5.0-1.el8_8
firefox-debugsource
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_8
0:140.5.0-1.el8_8
firefox
Red Hat:rhel_e4s:9.0::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el9_0
0:140.5.0-1.el9_0
firefox-debuginfo
Red Hat:rhel_e4s:9.0::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el9_0
0:140.5.0-1.el9_0
firefox-debugsource
Red Hat:rhel_e4s:9.0::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el9_0
0:140.5.0-1.el9_0
firefox
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el9_4
0:140.5.0-1.el9_4
firefox-debuginfo
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el9_4
0:140.5.0-1.el9_4
firefox-debugsource
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el9_4
0:140.5.0-1.el9_4
firefox-x11
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el9_4
0:140.5.0-1.el9_4
firefox
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el9_2
0:140.5.0-1.el9_2
firefox-debuginfo
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el9_2
0:140.5.0-1.el9_2
firefox-debugsource
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el9_2
0:140.5.0-1.el9_2
firefox-x11
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el9_2
0:140.5.0-1.el9_2
thunderbird
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el9_4
0:140.5.0-1.el9_4
thunderbird-debuginfo
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el9_4
0:140.5.0-1.el9_4
thunderbird-debugsource
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el9_4
0:140.5.0-1.el9_4
thunderbird
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el9_2
0:140.5.0-1.el9_2
thunderbird-debuginfo
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el9_2
0:140.5.0-1.el9_2
thunderbird-debugsource
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el9_2
0:140.5.0-1.el9_2
thunderbird
Red Hat:rhel_e4s:9.0::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el9_0
0:140.5.0-1.el9_0
thunderbird-debuginfo
Red Hat:rhel_e4s:9.0::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el9_0
0:140.5.0-1.el9_0
thunderbird-debugsource
Red Hat:rhel_e4s:9.0::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el9_0
0:140.5.0-1.el9_0
thunderbird
Red Hat:rhel_aus:8.4::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_4
0:140.5.0-1.el8_4
thunderbird-debuginfo
Red Hat:rhel_aus:8.4::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_4
0:140.5.0-1.el8_4
thunderbird-debugsource
Red Hat:rhel_aus:8.4::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_4
0:140.5.0-1.el8_4
thunderbird
Red Hat:rhel_eus_long_life:8.4::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_4
0:140.5.0-1.el8_4
thunderbird-debuginfo
Red Hat:rhel_eus_long_life:8.4::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_4
0:140.5.0-1.el8_4
thunderbird-debugsource
Red Hat:rhel_eus_long_life:8.4::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_4
0:140.5.0-1.el8_4
thunderbird
Red Hat:rhel_aus:8.2::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_2
0:140.5.0-1.el8_2
thunderbird-debuginfo
Red Hat:rhel_aus:8.2::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_2
0:140.5.0-1.el8_2
thunderbird-debugsource
Red Hat:rhel_aus:8.2::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_2
0:140.5.0-1.el8_2
thunderbird
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_8
0:140.5.0-1.el8_8
thunderbird-debuginfo
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_8
0:140.5.0-1.el8_8
thunderbird-debugsource
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_8
0:140.5.0-1.el8_8
thunderbird
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_8
0:140.5.0-1.el8_8
thunderbird-debuginfo
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_8
0:140.5.0-1.el8_8
thunderbird-debugsource
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_8
0:140.5.0-1.el8_8
thunderbird
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_6
0:140.5.0-1.el8_6
thunderbird-debuginfo
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_6
0:140.5.0-1.el8_6
thunderbird-debugsource
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_6
0:140.5.0-1.el8_6
thunderbird
Red Hat:rhel_e4s:8.6::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_6
0:140.5.0-1.el8_6
thunderbird-debuginfo
Red Hat:rhel_e4s:8.6::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_6
0:140.5.0-1.el8_6
thunderbird-debugsource
Red Hat:rhel_e4s:8.6::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_6
0:140.5.0-1.el8_6
thunderbird
Red Hat:rhel_tus:8.6::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_6
0:140.5.0-1.el8_6
thunderbird-debuginfo
Red Hat:rhel_tus:8.6::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_6
0:140.5.0-1.el8_6
thunderbird-debugsource
Red Hat:rhel_tus:8.6::appstream
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_6
0:140.5.0-1.el8_6
firefox
Rocky Linux:9
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el9_7
0:140.5.0-1.el9_7
firefox
Rocky Linux:10
From an advisory covering 9 CVEs
 before 0:140.5.0-2.el10_1
0:140.5.0-2.el10_1
thunderbird
Rocky Linux:10
From an advisory covering 9 CVEs
 before 0:140.5.0-2.el10_1
0:140.5.0-2.el10_1
thunderbird
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:140.5.0-2.el8_10
0:140.5.0-2.el8_10
firefox
Rocky Linux:8
From an advisory covering 9 CVEs
 before 0:140.5.0-1.el8_10
0:140.5.0-1.el8_10
MozillaFirefox
SUSE:Linux Enterprise Server 16.0
From an advisory covering 24 CVEs
 before 140.5.0-160000.1.1
140.5.0-160000.1.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 24 CVEs
 before 140.5.0-160000.1.1
140.5.0-160000.1.1
MozillaFirefox
SUSE:Linux Enterprise Module for Desktop Applications 15 SP6
From an advisory covering 17 CVEs
 before 140.5.0-150200.152.210.1
140.5.0-150200.152.210.1
MozillaFirefox
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
From an advisory covering 17 CVEs
 before 140.5.0-150200.152.210.1
140.5.0-150200.152.210.1
MozillaFirefox
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
From an advisory covering 17 CVEs
 before 140.5.0-150200.152.210.1
140.5.0-150200.152.210.1
MozillaFirefox
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 17 CVEs
 before 140.5.0-150200.152.210.1
140.5.0-150200.152.210.1
MozillaFirefox
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 17 CVEs
 before 140.5.0-150200.152.210.1
140.5.0-150200.152.210.1
MozillaFirefox
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 17 CVEs
 before 140.5.0-150200.152.210.1
140.5.0-150200.152.210.1
MozillaFirefox
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 17 CVEs
 before 140.5.0-150200.152.210.1
140.5.0-150200.152.210.1
MozillaFirefox
SUSE:Linux Enterprise Server 15 SP3-LTSS
From an advisory covering 17 CVEs
 before 140.5.0-150200.152.210.1
140.5.0-150200.152.210.1
MozillaFirefox
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 17 CVEs
 before 140.5.0-150200.152.210.1
140.5.0-150200.152.210.1
MozillaFirefox
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 17 CVEs
 before 140.5.0-150200.152.210.1
140.5.0-150200.152.210.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
From an advisory covering 17 CVEs
 before 140.5.0-150200.152.210.1
140.5.0-150200.152.210.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 17 CVEs
 before 140.5.0-150200.152.210.1
140.5.0-150200.152.210.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 17 CVEs
 before 140.5.0-150200.152.210.1
140.5.0-150200.152.210.1
MozillaFirefox
SUSE:Enterprise Storage 7.1
From an advisory covering 17 CVEs
 before 140.5.0-150200.152.210.1
140.5.0-150200.152.210.1
MozillaFirefox
openSUSE:Leap 15.6
From an advisory covering 17 CVEs
 before 140.5.0-150200.152.210.1
140.5.0-150200.152.210.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 17 CVEs
 before 140.5.0-112.289.1
140.5.0-112.289.1
MozillaFirefox
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 17 CVEs
 before 140.5.0-112.289.1
140.5.0-112.289.1
MozillaThunderbird
SUSE:Linux Enterprise Module for Package Hub 15 SP6
From an advisory covering 9 CVEs
 before 140.5.0-150200.8.245.1
140.5.0-150200.8.245.1
MozillaThunderbird
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 9 CVEs
 before 140.5.0-150200.8.245.1
140.5.0-150200.8.245.1
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15 SP6
From an advisory covering 9 CVEs
 before 140.5.0-150200.8.245.1
140.5.0-150200.8.245.1
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15 SP7
From an advisory covering 9 CVEs
 before 140.5.0-150200.8.245.1
140.5.0-150200.8.245.1
MozillaThunderbird
openSUSE:Leap 15.6
From an advisory covering 9 CVEs
 before 140.5.0-150200.8.245.1
140.5.0-150200.8.245.1
mozjs52
Ubuntu:18.04:LTS
 All versions, plus listed versions
52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1
 None known
mozjs38
Ubuntu:18.04:LTS
 All versions, plus listed versions
38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4
 None known
mozjs68
Ubuntu:20.04:LTS
 All versions, plus listed versions
68.5.0-1~fakesync68.5.0-2~fakesync68.6.0-168.6.0-1ubuntu1
 None known
mozjs52
Ubuntu:20.04:LTS
 All versions, plus listed versions
52.9.1-1build152.9.1-1ubuntu3
 None known
mozjs102
Ubuntu:22.04:LTS
 All versions, plus listed versions
102.11.0-0ubuntu0.22.04.1102.12.0-0ubuntu0.22.04.1102.13.0-0ubuntu0.22.04.1102.15.1-0ubuntu0.22.04.1
 None known
mozjs78
Ubuntu:22.04:LTS
 All versions, plus listed versions
78.13.0-178.15.0-278.15.0-4ubuntu1
 None known
mozjs91
Ubuntu:22.04:LTS
 All versions, plus listed versions
91.5.1-0ubuntu191.6.0-191.6.0-291.7.0-291.10.0-0ubuntu1
 None known
thunderbird
Ubuntu:22.04:LTS
 before 1:140.7.1+build1-0ubuntu0.22.04.1, plus listed versions
1:91.1.2+build1-0ubuntu11:91.3.0+build2-0ubuntu11:91.3.1+build1-0ubuntu11:91.3.2+build1-0ubuntu11:91.4.0+build1.1-0ubuntu1
Show 33 moreShow less
1:91.4.0+build2-0ubuntu11:91.5.0+build1-0ubuntu11:91.5.1+build1-0ubuntu11:91.6.1+build1-0ubuntu11:91.7.0+build1-0ubuntu11:91.7.0+build2-0ubuntu11:91.8.0+build2-0ubuntu11:91.9.1+build1-0ubuntu0.22.04.11:91.11.0+build2-0ubuntu0.22.04.11:102.2.2+build1-0ubuntu0.22.04.11:102.4.2+build2-0ubuntu0.22.04.11:102.7.1+build2-0ubuntu0.22.04.11:102.8.0+build2-0ubuntu0.22.04.11:102.9.0+build1-0ubuntu0.22.04.11:102.10.0+build2-0ubuntu0.22.04.11:102.11.0+build1-0ubuntu0.22.04.11:102.13.0+build1-0ubuntu0.22.04.11:102.15.0+build1-0ubuntu0.22.04.11:102.15.1+build1-0ubuntu0.22.04.11:115.3.1+build1-0ubuntu0.22.04.21:115.4.1+build1-0ubuntu0.22.04.11:115.5.0+build1-0ubuntu0.22.04.11:115.6.0+build2-0ubuntu0.22.04.11:115.8.1+build1-0ubuntu0.22.04.11:115.9.0+build1-0ubuntu0.22.04.11:115.10.1+build1-0ubuntu0.22.04.11:115.11.0+build2-0ubuntu0.22.04.11:115.12.0+build3-0ubuntu0.22.04.11:115.13.0+build5-0ubuntu0.22.04.11:115.15.0+build1-0ubuntu0.22.04.11:115.16.0+build2-0ubuntu0.22.04.11:115.18.0+build1-0ubuntu0.22.04.11:128.12.0+build1-0ubuntu0.22.04.1
1:140.7.1+build1-0ubuntu0.22.04.1
mozjs102
Ubuntu:24.04:LTS
 All versions, plus listed versions
102.15.1-1102.15.1-3ubuntu2
 None known
mozjs115
Ubuntu:24.04:LTS
 All versions, plus listed versions
115.3.0-0ubuntu1115.4.0-2115.5.0-1115.6.0-1115.7.0-4
Show 4 moreShow less
115.8.0-1115.9.0-1115.9.0-1build1115.10.0-1
 None known
MozillaFirefox
openSUSE:Tumbleweed
From an advisory covering 16 CVEs
 before 145.0-1.1
145.0-1.1
MozillaThunderbird
openSUSE:Tumbleweed
From an advisory covering 9 CVEs
 before 140.5.0-1.1
140.5.0-1.1
MozillaFirefox
openSUSE:Leap 16.0
From an advisory covering 24 CVEs
 before 140.5.0-160000.1.1
140.5.0-160000.1.1
firefox-esr
openSUSE:Tumbleweed
From an advisory covering 228 CVEs
 before 153.0-1.1
153.0-1.1
MozillaThunderbird
openSUSE:Leap 16.0
From an advisory covering 9 CVEs
 before 140.5.0-bp160.1.1
140.5.0-bp160.1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-13017 is a high vulnerability (CVSS 8.1) in Mozilla Firefox, published November 11, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 20th percentile. Fixed in firefox-esr 140.5.0esr-1~deb12u1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 859 versions and 182 references. The JSON record has them. Left out on purpose, here and in the API, to keep responses small: 9 source records.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open