CVE-2025-6426

These are all security issues fixed in the MozillaThunderbird-128.12.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libmozjs-128-0-128.12.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the MozillaFirefox-140.0.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for mozjs128 fixes the following issues:

• Update to version 128.14.0 (bsc#1248162):

  • CVE-2025-9179: Sandbox escape due to invalid pointer in the Audio/Video: GMP component
  • CVE-2025-9180: Same-origin policy bypass in the Graphics: Canvas2D component
  • CVE-2025-9181: Uninitialized memory in the JavaScript Engine component
  • CVE-2025-9185: Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142

• Update to version 128.13.0:

  • CVE-2025-8027: JavaScript engine only wrote partial return value to stack
  • CVE-2025-8028: Large branch table could lead to truncated instruction
  • CVE-2025-8029: javascript: URLs executed on object and embed tags
  • CVE-2025-8030: Potential user-assisted code execution in “Copy as cURL” command
  • CVE-2025-8031: Incorrect URL stripping in CSP reports
  • CVE-2025-8032: XSLT documents could bypass CSP
  • CVE-2025-8033: Incorrect JavaScript state machine for generators
  • CVE-2025-8034: Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  • CVE-2025-8035: Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141

• Update to version 128.12.0:

  • CVE-2025-6424: Use-after-free in FontFaceSet
  • CVE-2025-6425: The WebCompat WebExtension shipped with Firefox exposed a persistent UUID
  • CVE-2025-6426: No warning when opening executable terminal files on macOS
  • CVE-2025-6429: Incorrect parsing of URLs could have allowed embedding of youtube.com
  • CVE-2025-6430: Content-Disposition header ignored when a file is included in an embed or object tag

• Update to version 128.11.0:

  • CVE-2025-5283: Double-free in libvpx encoder
  • CVE-2025-5263: Error handling for script execution was incorrectly isolated from web content
  • CVE-2025-5264: Potential local code execution in “Copy as cURL” command
  • CVE-2025-5265: Potential local code execution in “Copy as cURL” command
  • CVE-2025-5266: Script element events leaked cross-origin resource status
  • CVE-2025-5267: Clickjacking vulnerability could have led to leaking saved payment card details
  • CVE-2025-5268: Memory safety bugs fixed in Firefox 139, Thunderbird 139, Firefox ESR 128.11, and Thunderbird 128.11
  • CVE-2025-5269: Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird 128.11

This update for mozjs128 fixes the following issues:

• Update to version 128.14.0 (bsc#1248162):

  • CVE-2025-9179: Sandbox escape due to invalid pointer in the Audio/Video: GMP component
  • CVE-2025-9180: Same-origin policy bypass in the Graphics: Canvas2D component
  • CVE-2025-9181: Uninitialized memory in the JavaScript Engine component
  • CVE-2025-9185: Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142

• Update to version 128.13.0:

  • CVE-2025-8027: JavaScript engine only wrote partial return value to stack
  • CVE-2025-8028: Large branch table could lead to truncated instruction
  • CVE-2025-8029: javascript: URLs executed on object and embed tags
  • CVE-2025-8030: Potential user-assisted code execution in “Copy as cURL” command
  • CVE-2025-8031: Incorrect URL stripping in CSP reports
  • CVE-2025-8032: XSLT documents could bypass CSP
  • CVE-2025-8033: Incorrect JavaScript state machine for generators
  • CVE-2025-8034: Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  • CVE-2025-8035: Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141

• Update to version 128.12.0:

  • CVE-2025-6424: Use-after-free in FontFaceSet
  • CVE-2025-6425: The WebCompat WebExtension shipped with Firefox exposed a persistent UUID
  • CVE-2025-6426: No warning when opening executable terminal files on macOS
  • CVE-2025-6429: Incorrect parsing of URLs could have allowed embedding of youtube.com
  • CVE-2025-6430: Content-Disposition header ignored when a file is included in an embed or object tag

• Update to version 128.11.0:

  • CVE-2025-5283: Double-free in libvpx encoder
  • CVE-2025-5263: Error handling for script execution was incorrectly isolated from web content
  • CVE-2025-5264: Potential local code execution in “Copy as cURL” command
  • CVE-2025-5265: Potential local code execution in “Copy as cURL” command
  • CVE-2025-5266: Script element events leaked cross-origin resource status
  • CVE-2025-5267: Clickjacking vulnerability could have led to leaking saved payment card details
  • CVE-2025-5268: Memory safety bugs fixed in Firefox 139, Thunderbird 139, Firefox ESR 128.11, and Thunderbird 128.11
  • CVE-2025-5269: Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird 128.11

This update for MozillaFirefox fixes the following issues:

Update to MozillaFirefox 128.12.0 (MFSA 2025-23, bsc#1244670):

• CVE-2025-6424: Use-after-free in FontFaceSet
• CVE-2025-6425: The WebCompat WebExtension shipped with Firefox exposed a persistent UUID
• CVE-2025-6426: No warning when opening executable terminal files on macOS
• CVE-2025-6429: Incorrect parsing of URLs could have allowed embedding of youtube.com
• CVE-2025-6430: Content-Disposition header ignored when a file is included in an embed or object tag

This update for MozillaFirefox fixes the following issues:

Update to MozillaFirefox 128.12.0 (MFSA 2025-23, bsc#1244670):

• CVE-2025-6424: Use-after-free in FontFaceSet
• CVE-2025-6425: The WebCompat WebExtension shipped with Firefox exposed a persistent UUID
• CVE-2025-6426: No warning when opening executable terminal files on macOS
• CVE-2025-6429: Incorrect parsing of URLs could have allowed embedding of youtube.com
• CVE-2025-6430: Content-Disposition header ignored when a file is included in an embed or object tag

This update for MozillaFirefox, MozillaFirefox-branding-SLE fixes the following issues:

This is the Firefox Extended Support Release 140.0esr ESR

Major changes:

General:

• Reader View now has an enhanced Text and Layout menu with new options for character spacing, word spacing, and text alignment. These changes offer a more accessible reading experience.
• Reader View now has a Theme menu with additional Contrast and Gray options. You can also select custom colors for text, background, and links from the Custom tab.
• Firefox will now offer to temporarily remember when users grant permissions to sites (e.g. geolocation). Temporary permissions will be removed either after one hour or when the tab is closed.
• Firefox now includes safeguards to prevent sites from abusing the history API by generating excessive history entries, which can make navigating with the back and forward buttons difficult by cluttering the history. This intervention ensures that such entries, unless interacted with by the user, are skipped when using the back and forward buttons.
• Firefox now identifies all links in PDFs and turns them into hyperlinks.
• You can now copy links from background tabs using the tabstrip context menu on macOS and Linux.
• Users on macOS and Linux are now given the option to close only the current tab if the Quit keyboard shortcut is used while multiple tabs are open in the window. (bmo#None)

Sidebar and Tabs:

• You can now enable the updated Firefox sidebar in Settings

  General > Browser Layout to quickly access multiple tools in one click, without leaving your main view. Sidebar tools include an AI chatbot of your choice, bookmarks, history, and tabs from devices you sync with your Mozilla account.

• Keep a lot of tabs open? Try our new vertical tabs layout to quickly scan your list of tabs. With vertical tabs, your open and pinned tabs appear in the sidebar instead of along the top of the browser. To turn on vertical tabs, right-click on the toolbar near the top of the browser and select Turn on Vertical Tabs. If you’ve enabled the updated sidebar, you can also go to Customize sidebar and check Vertical tabs. Early testers report feeling more organized after using vertical tabs for a few days.
• Stay productive and organized with less effort by grouping related tabs together. One simple way to create a group is to drag a tab onto another, pause until you see a highlight, then drop to create the group. Tab groups can be named, color-coded, and are always saved. You can close a group and reopen it later.
• A tab preview is now displayed when hovering the mouse over background tabs, making it easier to locate the desired tab without needing to switch tabs.
• The sidebar to view tabs from other devices can now be opened via the Tab overview menu.

Security & Privacy:

• HTTPS is replacing HTTP as the default protocol in the address bar on non-local sites. If a site is not available via HTTPS, Firefox will fall back to HTTP.
• Firefox now blocks third-party cookie access when Enhanced Tracking Protection's Strict mode is enabled.
• Firefox now has a new anti-tracking feature, Bounce Tracking Protection, which is now available in Enhanced Tracking Protection's 'Strict' mode. This feature detects bounce trackers based on their redirect behavior and periodically purges their cookies and site data to block tracking.
• Firefox now enforces certificate transparency, requiring web servers to provide sufficient proof that their certificates were publicly disclosed before they will be trusted. This only affects servers using certificates issued by a certificate authority in Mozilla's Root CA Program.
• Smartblock Embeds allows users to selectively unblock certain social media embeds that are…

This update for MozillaThunderbird fixes the following issues:

Update to Mozilla Thunderbird 128.12 (MFSA 2025-55, bsc#1244670):

• CVE-2025-6424: Use-after-free in FontFaceSet (bmo#1966423)
• CVE-2025-6425: The WebCompat WebExtension shipped exposed a persistent UUID (bmo#1717672)
• CVE-2025-6426: No warning when opening executable terminal files on macOS (bmo#1964385)
• CVE-2025-6429: Incorrect parsing of URLs could have allowed embedding of youtube.com (bmo#1970658)
• CVE-2025-6430: Content-Disposition header ignored when a file is included in an embed or object tag (bmo#1971140)

This update for MozillaFirefox, MozillaFirefox-branding-SLE fixes the following issues:

MozillaFirefox is updated to the 140ESR series.

Firefox Extended Support Release 140.0esr ESR:

• General

• Reader View now has an enhanced Text and Layout menu with new options for character spacing, word spacing, and text alignment. These changes offer a more accessible reading experience.
• Reader View now has a Theme menu with additional Contrast and Gray options. You can also select custom colors for text, background, and links from the Custom tab.
• Firefox will now offer to temporarily remember when users grant permissions to sites (e.g. geolocation). Temporary permissions will be removed either after one hour or when the tab is closed.
• Firefox now includes safeguards to prevent sites from abusing the history API by generating excessive history entries, which can make navigating with the back and forward buttons difficult by cluttering the history. This intervention ensures that such entries, unless interacted with by the user, are skipped when using the back and forward buttons.
• Firefox now identifies all links in PDFs and turns them into hyperlinks.
• You can now copy links from background tabs using the tabstrip context menu on macOS and Linux.
• Users on macOS and Linux are now given the option to close only the current tab if the Quit keyboard shortcut is used while multiple tabs are open in the window. (bmo#None)

• Sidebar and Tabs

• You can now enable the updated Firefox sidebar in Settings

  General > Browser Layout to quickly access multiple tools in one click, without leaving your main view. Sidebar tools include an AI chatbot of your choice, bookmarks, history, and tabs from devices you sync with your Mozilla account.

• Keep a lot of tabs open? Try our new vertical tabs layout to quickly scan your list of tabs. With vertical tabs, your open and pinned tabs appear in the sidebar instead of along the top of the browser. To turn on vertical tabs, right-click on the toolbar near the top of the browser and select Turn on Vertical Tabs. If you’ve enabled the updated sidebar, you can also go to Customize sidebar and check Vertical tabs. Early testers report feeling more organized after using vertical tabs for a few days.
• Stay productive and organized with less effort by grouping related tabs together. One simple way to create a group is to drag a tab onto another, pause until you see a highlight, then drop to create the group. Tab groups can be named, color-coded, and are always saved. You can close a group and reopen it later.
• A tab preview is now displayed when hovering the mouse over background tabs, making it easier to locate the desired tab without needing to switch tabs.
• The sidebar to view tabs from other devices can now be opened via the Tab overview menu.

• Security & Privacy

• HTTPS is replacing HTTP as the default protocol in the address bar on non-local sites. If a site is not available via HTTPS, Firefox will fall back to HTTP.
• Firefox now blocks third-party cookie access when Enhanced Tracking Protection's Strict mode is enabled.
• Firefox now has a new anti-tracking feature, Bounce Tracking Protection, which is now available in Enhanced Tracking Protection's 'Strict' mode. This feature detects bounce trackers based on their redirect behavior and periodically purges their cookies and site data to block tracking.
• Firefox now enforces certificate transparency, requiring web servers to provide sufficient proof that their certificates were publicly disclosed before they will be trusted. This only affects servers using certificates issued by a certificate authority in Mozilla's Root CA Program.
• Smartblock Embeds allows users to selectively unblock certain…

This update for MozillaThunderbird fixes the following issues:

Update to Mozilla Thunderbird 140.1 (MFSA 2025-63) (bsc#1246664):

• CVE-2025-8027: JavaScript engine only wrote partial return value to stack (bmo#1968423)
• CVE-2025-8028: Large branch table could lead to truncated instruction (bmo#1971581)
• CVE-2025-8029: javascript: URLs executed on object and embed tags (bmo#1928021)
• CVE-2025-8036: DNS rebinding circumvents CORS (bmo#1960834)
• CVE-2025-8037: Nameless cookies shadow secure cookies (bmo#1964767)
• CVE-2025-8030: Potential user-assisted code execution in 'Copy as cURL' command (bmo#1968414)
• CVE-2025-8031: Incorrect URL stripping in CSP reports (bmo#1971719)
• CVE-2025-8032: XSLT documents could bypass CSP (bmo#1974407)
• CVE-2025-8038: CSP frame-src was not correctly enforced for paths (bmo#1808979)
• CVE-2025-8039: Search terms persisted in URL bar (bmo#1970997)
• CVE-2025-8033: Incorrect JavaScript state machine for generators (bmo#1973990)
• CVE-2025-8034: Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
• CVE-2025-8040: Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
• CVE-2025-8035: Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141 (bmo#1975961, bmo#1975961, bmo#1975961)

Update to Mozilla Thunderbird 140.0.1 (MFSA 2025-54) (bsc#1244670):

• CVE-2025-6424: Use-after-free in FontFaceSet (bmo#1966423)
• CVE-2025-6425: The WebCompat WebExtension shipped exposed a persistent UUID (bmo#1717672)
• CVE-2025-6426: No warning when opening executable terminal files on macOS (bmo#1964385)
• CVE-2025-6427: connect-src Content Security Policy restriction could be bypassed (bmo#1966927)
• CVE-2025-6429: Incorrect parsing of URLs could have allowed embedding of youtube.com (bmo#1970658)
• CVE-2025-6430: Content-Disposition header ignored when a file is included in an embed or object tag (bmo#1971140)
• CVE-2025-6432: DNS Requests leaked outside of a configured SOCKS proxy (bmo#1943804)
• CVE-2025-6433: WebAuthn would allow a user to sign a challenge on a webpage with an invalid TLS certificate (bmo#1954033)
• CVE-2025-6434: HTTPS-Only exception screen lacked anti-clickjacking delay (bmo#1955182)
• CVE-2025-6435: Save as in Devtools could download files without sanitizing the extension (bmo#1950056, bmo#1961777)
• CVE-2025-6436: Memory safety bugs fixed in Firefox 140 and Thunderbird 140 (bmo#1941377, bmo#1960948, bmo#1966187, bmo#1966505, bmo#1970764)

This update for mozjs128 fixes the following issues:

• Update to version 128.14.0 (bsc#1248162):

  • CVE-2025-9179: Sandbox escape due to invalid pointer in the Audio/Video: GMP component
  • CVE-2025-9180: Same-origin policy bypass in the Graphics: Canvas2D component
  • CVE-2025-9181: Uninitialized memory in the JavaScript Engine component
  • CVE-2025-9185: Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142

• Update to version 128.13.0:

  • CVE-2025-8027: JavaScript engine only wrote partial return value to stack
  • CVE-2025-8028: Large branch table could lead to truncated instruction
  • CVE-2025-8029: javascript: URLs executed on object and embed tags
  • CVE-2025-8030: Potential user-assisted code execution in “Copy as cURL” command
  • CVE-2025-8031: Incorrect URL stripping in CSP reports
  • CVE-2025-8032: XSLT documents could bypass CSP
  • CVE-2025-8033: Incorrect JavaScript state machine for generators
  • CVE-2025-8034: Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  • CVE-2025-8035: Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141

• Update to version 128.12.0:

  • CVE-2025-6424: Use-after-free in FontFaceSet
  • CVE-2025-6425: The WebCompat WebExtension shipped with Firefox exposed a persistent UUID
  • CVE-2025-6426: No warning when opening executable terminal files on macOS
  • CVE-2025-6429: Incorrect parsing of URLs could have allowed embedding of youtube.com
  • CVE-2025-6430: Content-Disposition header ignored when a file is included in an embed or object tag

• Update to version 128.11.0:

  • CVE-2025-5283: Double-free in libvpx encoder
  • CVE-2025-5263: Error handling for script execution was incorrectly isolated from web content
  • CVE-2025-5264: Potential local code execution in “Copy as cURL” command
  • CVE-2025-5265: Potential local code execution in “Copy as cURL” command
  • CVE-2025-5266: Script element events leaked cross-origin resource status
  • CVE-2025-5267: Clickjacking vulnerability could have led to leaking saved payment card details
  • CVE-2025-5268: Memory safety bugs fixed in Firefox 139, Thunderbird 139, Firefox ESR 128.11, and Thunderbird 128.11
  • CVE-2025-5269: Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird 128.11

Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass security restrictions, cross-site tracing, or execute arbitrary code.