CVE-2025-8039
Search terms persisted in URL bar
In some cases search terms persisted in the URL bar even after navigating away from the search page. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Search terms persisted in URL bar
In some cases search terms persisted in the URL bar even after navigating away from the search page. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.
- Record
CVE-2025-8039- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2025-22363
In some cases search terms persisted in the URL bar even after navigating away from the search page. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.
- Record
EUVD-2025-22363- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-gg2x-qqv2-xfhc
In some cases search terms persisted in the URL bar even after navigating away from the search...
In some cases search terms persisted in the URL bar even after navigating away from the search page. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.
- Record
GHSA-gg2x-qqv2-xfhc- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
NVD
In some cases search terms persisted in the URL bar even after navigating away from the search page. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.
- Record
CVE-2025-8039- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVOESA-2025-2340
firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global moz_debug_prefix /lib/debug %global moz_debug_dir /lib/debug/ %global uname_m %(uname -m) %global symbols_file_name -.en-US.-%(uname.crashreporter-symbols.zip %global symbols_file_path /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip %global _find_debuginfo_opts -p /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip -o debugcrashreporter.list %global crashreporter_pkg_name mozilla-crashreporter--debuginfo
Security Fix(es):
This vulnerability affects Firefox versions prior to 143 and Firefox ESR versions prior to 140.3. Specific vulnerability type and impact details require further confirmation.(CVE-2025-10527)
This vulnerability affects Firefox < 143 and Firefox ESR < 140.3.(CVE-2025-10528)
This vulnerability affects Firefox versions earlier than 143 and Firefox ESR versions earlier than 140.3. The vulnerability may lead to security bypass or other security issues.(CVE-2025-10529)
This vulnerability affects Firefox < 143 and Firefox ESR < 140.3.(CVE-2025-10532)
This vulnerability affects Firefox < 143, Firefox ESR < 115.28, and Firefox ESR < 140.3. Specific vulnerability details require further analysis.(CVE-2025-10533)
This vulnerability affects Firefox < 143 and Firefox ESR < 140.3.(CVE-2025-10536)
Memory safety bugs present in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 143 and Firefox ESR < 140.3.(CVE-2025-10537)
Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.(CVE-2025-8036)
Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie included the Secure attribute. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.(CVE-2025-8037)
Thunderbird ignored paths when checking the validity of navigations in a frame. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.(CVE-2025-8038)
In some cases search terms persisted in the URL bar even after navigating away from the search page. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.(CVE-2025-8039)
Memory safety bugs present in Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.(CVE-2025-8040)
Spoofing issue in the Address Bar component. This vulnerability affects Firefox < 142 and Firefox ESR < 140.2.(CVE-2025-9183)
- Record
OESA-2025-2340- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2025-2341
firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global moz_debug_prefix /lib/debug %global moz_debug_dir /lib/debug/ %global uname_m %(uname -m) %global symbols_file_name -.en-US.-%(uname.crashreporter-symbols.zip %global symbols_file_path /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip %global _find_debuginfo_opts -p /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip -o debugcrashreporter.list %global crashreporter_pkg_name mozilla-crashreporter--debuginfo
Security Fix(es):
This vulnerability affects Firefox versions prior to 143 and Firefox ESR versions prior to 140.3. Specific vulnerability type and impact details require further confirmation.(CVE-2025-10527)
This vulnerability affects Firefox < 143 and Firefox ESR < 140.3.(CVE-2025-10528)
This vulnerability affects Firefox versions earlier than 143 and Firefox ESR versions earlier than 140.3. The vulnerability may lead to security bypass or other security issues.(CVE-2025-10529)
This vulnerability affects Firefox < 143 and Firefox ESR < 140.3.(CVE-2025-10532)
This vulnerability affects Firefox < 143, Firefox ESR < 115.28, and Firefox ESR < 140.3. Specific vulnerability details require further analysis.(CVE-2025-10533)
This vulnerability affects Firefox < 143 and Firefox ESR < 140.3.(CVE-2025-10536)
Memory safety bugs present in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 143 and Firefox ESR < 140.3.(CVE-2025-10537)
Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.(CVE-2025-8036)
Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie included the Secure attribute. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.(CVE-2025-8037)
Thunderbird ignored paths when checking the validity of navigations in a frame. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.(CVE-2025-8038)
In some cases search terms persisted in the URL bar even after navigating away from the search page. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.(CVE-2025-8039)
Memory safety bugs present in Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.(CVE-2025-8040)
Spoofing issue in the Address Bar component. This vulnerability affects Firefox < 142 and Firefox ESR < 140.2.(CVE-2025-9183)
- Record
OESA-2025-2341- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 10 moreShow less
OSVOESA-2025-2359
firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global moz_debug_prefix /lib/debug %global moz_debug_dir /lib/debug/ %global uname_m %(uname -m) %global symbols_file_name -.en-US.-%(uname.crashreporter-symbols.zip %global symbols_file_path /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip %global _find_debuginfo_opts -p /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip -o debugcrashreporter.list %global crashreporter_pkg_name mozilla-crashreporter--debuginfo
Security Fix(es):
This vulnerability affects Firefox versions prior to 143 and Firefox ESR versions prior to 140.3. Specific vulnerability type and impact details require further confirmation.(CVE-2025-10527)
This vulnerability affects Firefox < 143 and Firefox ESR < 140.3.(CVE-2025-10528)
This vulnerability affects Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3.(CVE-2025-10529)
This vulnerability affects Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3.(CVE-2025-10532)
This vulnerability affects Firefox < 143, Firefox ESR < 115.28, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3.(CVE-2025-10533)
This vulnerability affects Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3.(CVE-2025-10536)
Memory safety bugs present in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3.(CVE-2025-10537)
Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.(CVE-2025-8036)
Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie included the Secure attribute. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.(CVE-2025-8037)
Thunderbird ignored paths when checking the validity of navigations in a frame. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.(CVE-2025-8038)
In some cases search terms persisted in the URL bar even after navigating away from the search page. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.(CVE-2025-8039)
Memory safety bugs present in Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.(CVE-2025-8040)
Spoofing issue in the Address Bar component. This vulnerability affects Firefox < 142 and Firefox ESR < 140.2.(CVE-2025-9183)
- Record
OESA-2025-2359- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2025-2360
firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global moz_debug_prefix /lib/debug %global moz_debug_dir /lib/debug/ %global uname_m %(uname -m) %global symbols_file_name -.en-US.-%(uname.crashreporter-symbols.zip %global symbols_file_path /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip %global _find_debuginfo_opts -p /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip -o debugcrashreporter.list %global crashreporter_pkg_name mozilla-crashreporter--debuginfo
Security Fix(es):
This vulnerability affects Firefox versions prior to 143 and Firefox ESR versions prior to 140.3. Specific vulnerability type and impact details require further confirmation.(CVE-2025-10527)
This vulnerability affects Firefox < 143 and Firefox ESR < 140.3.(CVE-2025-10528)
This vulnerability affects Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3.(CVE-2025-10529)
This vulnerability affects Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3.(CVE-2025-10532)
This vulnerability affects Firefox < 143, Firefox ESR < 115.28, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3.(CVE-2025-10533)
This vulnerability affects Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3.(CVE-2025-10536)
Memory safety bugs present in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3.(CVE-2025-10537)
Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.(CVE-2025-8036)
Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie included the Secure attribute. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.(CVE-2025-8037)
Thunderbird ignored paths when checking the validity of navigations in a frame. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.(CVE-2025-8038)
In some cases search terms persisted in the URL bar even after navigating away from the search page. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.(CVE-2025-8039)
Memory safety bugs present in Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.(CVE-2025-8040)
Spoofing issue in the Address Bar component. This vulnerability affects Firefox < 142 and Firefox ESR < 140.2.(CVE-2025-9183)
- Record
OESA-2025-2360- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2025-2361
firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global moz_debug_prefix /lib/debug %global moz_debug_dir /lib/debug/ %global uname_m %(uname -m) %global symbols_file_name -.en-US.-%(uname.crashreporter-symbols.zip %global symbols_file_path /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip %global _find_debuginfo_opts -p /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip -o debugcrashreporter.list %global crashreporter_pkg_name mozilla-crashreporter--debuginfo
Security Fix(es):
This vulnerability affects Firefox versions prior to 143 and Firefox ESR versions prior to 140.3. Specific vulnerability type and impact details require further confirmation.(CVE-2025-10527)
This vulnerability affects Firefox < 143 and Firefox ESR < 140.3.(CVE-2025-10528)
This vulnerability affects Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3.(CVE-2025-10529)
This vulnerability affects Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3.(CVE-2025-10532)
This vulnerability affects Firefox < 143, Firefox ESR < 115.28, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3.(CVE-2025-10533)
This vulnerability affects Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3.(CVE-2025-10536)
Memory safety bugs present in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 143, Firefox ESR < 140.3, Thunderbird < 143, and Thunderbird < 140.3.(CVE-2025-10537)
Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.(CVE-2025-8036)
Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie included the Secure attribute. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.(CVE-2025-8037)
Thunderbird ignored paths when checking the validity of navigations in a frame. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.(CVE-2025-8038)
In some cases search terms persisted in the URL bar even after navigating away from the search page. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.(CVE-2025-8039)
Memory safety bugs present in Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.(CVE-2025-8040)
Spoofing issue in the Address Bar component. This vulnerability affects Firefox < 142 and Firefox ESR < 140.2.(CVE-2025-9183)
- Record
OESA-2025-2361- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-8039
In some cases search terms persisted in the URL bar even after navigating away from the search page. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.
- Record
UBUNTU-CVE-2025-8039- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15371-1 No score
firefox-esr-140.1.0-1.1 on GA media
These are all security issues fixed in the firefox-esr-140.1.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15371-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15383-1 No score
MozillaThunderbird-140.1.0-1.1 on GA media
These are all security issues fixed in the MozillaThunderbird-140.1.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15383-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15386-1 No score
MozillaFirefox-141.0-1.1 on GA media
These are all security issues fixed in the MozillaFirefox-141.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15386-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:02529-1 No score
Security update for MozillaFirefox, MozillaFirefox-branding-SLE
This update for MozillaFirefox, MozillaFirefox-branding-SLE fixes the following issues:
MozillaFirefox is updated to the 140ESR series.
Firefox Extended Support Release 140.0esr ESR:
- General
- Reader View now has an enhanced Text and Layout menu with new options for character spacing, word spacing, and text alignment. These changes offer a more accessible reading experience.
- Reader View now has a Theme menu with additional Contrast and Gray options. You can also select custom colors for text, background, and links from the Custom tab.
- Firefox will now offer to temporarily remember when users grant permissions to sites (e.g. geolocation). Temporary permissions will be removed either after one hour or when the tab is closed.
- Firefox now includes safeguards to prevent sites from abusing the history API by generating excessive history entries, which can make navigating with the back and forward buttons difficult by cluttering the history. This intervention ensures that such entries, unless interacted with by the user, are skipped when using the back and forward buttons.
- Firefox now identifies all links in PDFs and turns them into hyperlinks.
- You can now copy links from background tabs using the tabstrip context menu on macOS and Linux.
- Users on macOS and Linux are now given the option to close only the current tab if the Quit keyboard shortcut is used while multiple tabs are open in the window. (bmo#None)
- Sidebar and Tabs
- You can now enable the updated Firefox sidebar in Settings
General > Browser Layout to quickly access multiple tools in one click, without leaving your main view. Sidebar tools include an AI chatbot of your choice, bookmarks, history, and tabs from devices you sync with your Mozilla account.
- Keep a lot of tabs open? Try our new vertical tabs layout to quickly scan your list of tabs. With vertical tabs, your open and pinned tabs appear in the sidebar instead of along the top of the browser. To turn on vertical tabs, right-click on the toolbar near the top of the browser and select Turn on Vertical Tabs. If you’ve enabled the updated sidebar, you can also go to Customize sidebar and check Vertical tabs. Early testers report feeling more organized after using vertical tabs for a few days.
- Stay productive and organized with less effort by grouping related tabs together. One simple way to create a group is to drag a tab onto another, pause until you see a highlight, then drop to create the group. Tab groups can be named, color-coded, and are always saved. You can close a group and reopen it later.
- A tab preview is now displayed when hovering the mouse over background tabs, making it easier to locate the desired tab without needing to switch tabs.
- The sidebar to view tabs from other devices can now be opened via the Tab overview menu.
- Security & Privacy
- HTTPS is replacing HTTP as the default protocol in the address bar on non-local sites. If a site is not available via HTTPS, Firefox will fall back to HTTP.
- Firefox now blocks third-party cookie access when Enhanced Tracking Protection's Strict mode is enabled.
- Firefox now has a new anti-tracking feature, Bounce Tracking Protection, which is now available in Enhanced Tracking Protection's 'Strict' mode. This feature detects bounce trackers based on their redirect behavior and periodically purges their cookies and site data to block tracking.
- Firefox now enforces certificate transparency, requiring web servers to provide sufficient proof that their certificates were publicly disclosed before they will be trusted. This only affects servers using certificates issued by a certificate authority in Mozilla's Root CA Program.
- Smartblock Embeds allows users to selectively unblock certain…
- Record
SUSE-SU-2025:02529-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:02531-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues:
- Firefox Extended Support Release 140.1.0 ESR
- MFSA-RESERVE-2025-1968423 (bmo#1968423) JavaScript engine only wrote partial return value to stack
- MFSA-RESERVE-2025-1971581 (bmo#1971581) Large branch table could lead to truncated instruction
- MFSA-RESERVE-2025-1928021 (bmo#1928021) CSP does not block javascript: URLs on object and embed tags
- MFSA-RESERVE-2025-1960834 (bmo#1960834) DNS rebinding circumvents CORS
- MFSA-RESERVE-2025-1964767 (bmo#1964767) Nameless cookies shadow secure cookies
- MFSA-RESERVE-2025-1968414 (bmo#1968414) Potential user-assisted code execution in “Copy as cURL” command
- MFSA-RESERVE-2025-1971719 (bmo#1971719) Incorrect URL stripping in CSP reports
- MFSA-RESERVE-2025-1974407 (bmo#1974407) XSLT documents could by-pass CSP
- MFSA-RESERVE-2025-1808979 (bmo#1808979) CSP frame-src was not correctly enforced for paths
- MFSA-RESERVE-2025-1970997 (bmo#1970997) Search terms persist in URL bar
- MFSA-RESERVE-2025-1973990 (bmo#1973990) Incorrect JavaScript state machine for generators
- MFSA-RESERVE-2025-1 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422) Memory safety bugs fixed in Firefox ESR 115.26, Thunderbird ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
- MFSA-RESERVE-2025-2 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998) Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
- MFSA-RESERVE-2025-3 (bmo#1975961, bmo#1975961, bmo#1975961) Memory safety bugs fixed in Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
Various security fixes MFSA 2025-59 (bsc#1246664):
- CVE-2025-8027: JavaScript engine only wrote partial return value to stack
- CVE-2025-8028: Large branch table could lead to truncated instruction
- CVE-2025-8029: javascript: URLs executed on object and embed tags
- CVE-2025-8036: DNS rebinding circumvents CORS
- CVE-2025-8037: Nameless cookies shadow secure cookies
- CVE-2025-8030: Potential user-assisted code execution in “Copy as cURL” command
- CVE-2025-8031: Incorrect URL stripping in CSP reports
- CVE-2025-8032: XSLT documents could bypass CSP
- CVE-2025-8038: CSP frame-src was not correctly enforced for paths
- CVE-2025-8039: Search terms persisted in URL bar
- CVE-2025-8033: Incorrect JavaScript state machine for generators
- CVE-2025-8034: Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
- CVE-2025-8040: Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
- CVE-2025-8035: Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
- Record
SUSE-SU-2025:02531-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:02546-1 No score
Security update for MozillaThunderbird
This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird 140.1 (MFSA 2025-63) (bsc#1246664):
- CVE-2025-8027: JavaScript engine only wrote partial return value to stack (bmo#1968423)
- CVE-2025-8028: Large branch table could lead to truncated instruction (bmo#1971581)
- CVE-2025-8029: javascript: URLs executed on object and embed tags (bmo#1928021)
- CVE-2025-8036: DNS rebinding circumvents CORS (bmo#1960834)
- CVE-2025-8037: Nameless cookies shadow secure cookies (bmo#1964767)
- CVE-2025-8030: Potential user-assisted code execution in 'Copy as cURL' command (bmo#1968414)
- CVE-2025-8031: Incorrect URL stripping in CSP reports (bmo#1971719)
- CVE-2025-8032: XSLT documents could bypass CSP (bmo#1974407)
- CVE-2025-8038: CSP frame-src was not correctly enforced for paths (bmo#1808979)
- CVE-2025-8039: Search terms persisted in URL bar (bmo#1970997)
- CVE-2025-8033: Incorrect JavaScript state machine for generators (bmo#1973990)
- CVE-2025-8034: Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
- CVE-2025-8040: Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
- CVE-2025-8035: Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141 (bmo#1975961, bmo#1975961, bmo#1975961)
Update to Mozilla Thunderbird 140.0.1 (MFSA 2025-54) (bsc#1244670):
- CVE-2025-6424: Use-after-free in FontFaceSet (bmo#1966423)
- CVE-2025-6425: The WebCompat WebExtension shipped exposed a persistent UUID (bmo#1717672)
- CVE-2025-6426: No warning when opening executable terminal files on macOS (bmo#1964385)
- CVE-2025-6427: connect-src Content Security Policy restriction could be bypassed (bmo#1966927)
- CVE-2025-6429: Incorrect parsing of URLs could have allowed embedding of youtube.com (bmo#1970658)
- CVE-2025-6430: Content-Disposition header ignored when a file is included in an embed or object tag (bmo#1971140)
- CVE-2025-6432: DNS Requests leaked outside of a configured SOCKS proxy (bmo#1943804)
- CVE-2025-6433: WebAuthn would allow a user to sign a challenge on a webpage with an invalid TLS certificate (bmo#1954033)
- CVE-2025-6434: HTTPS-Only exception screen lacked anti-clickjacking delay (bmo#1955182)
- CVE-2025-6435: Save as in Devtools could download files without sanitizing the extension (bmo#1950056, bmo#1961777)
- CVE-2025-6436: Memory safety bugs fixed in Firefox 140 and Thunderbird 140 (bmo#1941377, bmo#1960948, bmo#1966187, bmo#1966505, bmo#1970764)
- Record
SUSE-SU-2025:02546-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
firefoxopenEuler:24.03-LTS-SP1 From an advisory covering 13 CVEs |
before 140.3.1-1.oe2403sp1 | 140.3.1-1.oe2403sp1 |
firefoxopenEuler:24.03-LTS-SP2 From an advisory covering 13 CVEs |
before 140.3.1-1.oe2403sp2 | 140.3.1-1.oe2403sp2 |
firefoxopenEuler:22.03-LTS-SP3 From an advisory covering 13 CVEs |
before 140.3.1-1.oe2203sp3 | 140.3.1-1.oe2203sp3 |
firefoxopenEuler:22.03-LTS-SP4 From an advisory covering 13 CVEs |
before 140.3.1-1.oe2203sp4 | 140.3.1-1.oe2203sp4 |
firefoxopenEuler:24.03-LTS From an advisory covering 13 CVEs |
before 128.14.0-1.oe2403 | 128.14.0-1.oe2403 |
MozillaFirefoxSUSE:Linux Enterprise Module for Desktop Applications 15 SP6 From an advisory covering 27 CVEs |
before 140.1.0-150200.152.193.1 | 140.1.0-150200.152.193.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Module for Desktop Applications 15 SP6 From an advisory covering 27 CVEs |
before 140-150200.9.21.1 | 140-150200.9.21.1 |
MozillaFirefoxSUSE:Linux Enterprise Module for Desktop Applications 15 SP7 From an advisory covering 27 CVEs |
before 140.1.0-150200.152.193.1 | 140.1.0-150200.152.193.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Module for Desktop Applications 15 SP7 From an advisory covering 27 CVEs |
before 140-150200.9.21.1 | 140-150200.9.21.1 |
pipewireSUSE:Linux Enterprise Module for Package Hub 15 SP6 From an advisory covering 27 CVEs |
before 0.3.6-150200.3.11.1 | 0.3.6-150200.3.11.1 |
Show 71 moreShow less
| Package | Affected | Fixed |
|---|---|---|
pipewireSUSE:Linux Enterprise Module for Package Hub 15 SP7 From an advisory covering 27 CVEs |
before 0.3.6-150200.3.11.1 | 0.3.6-150200.3.11.1 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS From an advisory covering 27 CVEs |
before 140.1.0-150200.152.193.1 | 140.1.0-150200.152.193.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS From an advisory covering 27 CVEs |
before 140-150200.9.21.1 | 140-150200.9.21.1 |
pipewireSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS From an advisory covering 27 CVEs |
before 0.3.24-150300.4.8.1 | 0.3.24-150300.4.8.1 |
xdg-desktop-portalSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS From an advisory covering 27 CVEs |
before 1.8.0-150200.5.8.1 | 1.8.0-150200.5.8.1 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 27 CVEs |
before 140.1.0-150200.152.193.1 | 140.1.0-150200.152.193.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 27 CVEs |
before 140-150200.9.21.1 | 140-150200.9.21.1 |
pipewireSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 27 CVEs |
before 0.3.49-150400.3.7.1 | 0.3.49-150400.3.7.1 |
xdg-desktop-portalSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 27 CVEs |
before 1.10.1-150400.3.8.1 | 1.10.1-150400.3.8.1 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 27 CVEs |
before 140.1.0-150200.152.193.1 | 140.1.0-150200.152.193.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 27 CVEs |
before 140-150200.9.21.1 | 140-150200.9.21.1 |
pipewireSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 27 CVEs |
before 0.3.49-150400.3.7.1 | 0.3.49-150400.3.7.1 |
xdg-desktop-portalSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 27 CVEs |
before 1.10.1-150400.3.8.1 | 1.10.1-150400.3.8.1 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 27 CVEs |
before 140.1.0-150200.152.193.1 | 140.1.0-150200.152.193.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 27 CVEs |
before 140-150200.9.21.1 | 140-150200.9.21.1 |
pipewireSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 27 CVEs |
before 0.3.64-150500.3.7.2 | 0.3.64-150500.3.7.2 |
xdg-desktop-portalSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 27 CVEs |
before 1.16.0-150500.3.8.1 | 1.16.0-150500.3.8.1 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 27 CVEs |
before 140.1.0-150200.152.193.1 | 140.1.0-150200.152.193.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 27 CVEs |
before 140-150200.9.21.1 | 140-150200.9.21.1 |
pipewireSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 27 CVEs |
before 0.3.64-150500.3.7.2 | 0.3.64-150500.3.7.2 |
xdg-desktop-portalSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 27 CVEs |
before 1.16.0-150500.3.8.1 | 1.16.0-150500.3.8.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 15 SP3-LTSS From an advisory covering 27 CVEs |
before 140.1.0-150200.152.193.1 | 140.1.0-150200.152.193.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Server 15 SP3-LTSS From an advisory covering 27 CVEs |
before 140-150200.9.21.1 | 140-150200.9.21.1 |
pipewireSUSE:Linux Enterprise Server 15 SP3-LTSS From an advisory covering 27 CVEs |
before 0.3.24-150300.4.8.1 | 0.3.24-150300.4.8.1 |
xdg-desktop-portalSUSE:Linux Enterprise Server 15 SP3-LTSS From an advisory covering 27 CVEs |
before 1.8.0-150200.5.8.1 | 1.8.0-150200.5.8.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 27 CVEs |
before 140.1.0-150200.152.193.1 | 140.1.0-150200.152.193.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 27 CVEs |
before 140-150200.9.21.1 | 140-150200.9.21.1 |
pipewireSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 27 CVEs |
before 0.3.49-150400.3.7.1 | 0.3.49-150400.3.7.1 |
xdg-desktop-portalSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 27 CVEs |
before 1.10.1-150400.3.8.1 | 1.10.1-150400.3.8.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 27 CVEs |
before 140.1.0-150200.152.193.1 | 140.1.0-150200.152.193.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 27 CVEs |
before 140-150200.9.21.1 | 140-150200.9.21.1 |
pipewireSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 27 CVEs |
before 0.3.64-150500.3.7.2 | 0.3.64-150500.3.7.2 |
xdg-desktop-portalSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 27 CVEs |
before 1.16.0-150500.3.8.1 | 1.16.0-150500.3.8.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 15 SP3 From an advisory covering 27 CVEs |
before 140.1.0-150200.152.193.1 | 140.1.0-150200.152.193.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Server for SAP Applications 15 SP3 From an advisory covering 27 CVEs |
before 140-150200.9.21.1 | 140-150200.9.21.1 |
pipewireSUSE:Linux Enterprise Server for SAP Applications 15 SP3 From an advisory covering 27 CVEs |
before 0.3.24-150300.4.8.1 | 0.3.24-150300.4.8.1 |
xdg-desktop-portalSUSE:Linux Enterprise Server for SAP Applications 15 SP3 From an advisory covering 27 CVEs |
before 1.8.0-150200.5.8.1 | 1.8.0-150200.5.8.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 27 CVEs |
before 140.1.0-150200.152.193.1 | 140.1.0-150200.152.193.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 27 CVEs |
before 140-150200.9.21.1 | 140-150200.9.21.1 |
pipewireSUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 27 CVEs |
before 0.3.49-150400.3.7.1 | 0.3.49-150400.3.7.1 |
xdg-desktop-portalSUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 27 CVEs |
before 1.10.1-150400.3.8.1 | 1.10.1-150400.3.8.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 27 CVEs |
before 140.1.0-150200.152.193.1 | 140.1.0-150200.152.193.1 |
MozillaFirefox-branding-SLESUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 27 CVEs |
before 140-150200.9.21.1 | 140-150200.9.21.1 |
pipewireSUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 27 CVEs |
before 0.3.64-150500.3.7.2 | 0.3.64-150500.3.7.2 |
xdg-desktop-portalSUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 27 CVEs |
before 1.16.0-150500.3.8.1 | 1.16.0-150500.3.8.1 |
MozillaFirefoxSUSE:Enterprise Storage 7.1 From an advisory covering 27 CVEs |
before 140.1.0-150200.152.193.1 | 140.1.0-150200.152.193.1 |
MozillaFirefox-branding-SLESUSE:Enterprise Storage 7.1 From an advisory covering 27 CVEs |
before 140-150200.9.21.1 | 140-150200.9.21.1 |
pipewireSUSE:Enterprise Storage 7.1 From an advisory covering 27 CVEs |
before 0.3.24-150300.4.8.1 | 0.3.24-150300.4.8.1 |
xdg-desktop-portalSUSE:Enterprise Storage 7.1 From an advisory covering 27 CVEs |
before 1.8.0-150200.5.8.1 | 1.8.0-150200.5.8.1 |
MozillaFirefoxopenSUSE:Leap 15.6 From an advisory covering 27 CVEs |
before 140.1.0-150200.152.193.1 | 140.1.0-150200.152.193.1 |
MozillaFirefox-branding-SLEopenSUSE:Leap 15.6 From an advisory covering 27 CVEs |
before 140-150200.9.21.1 | 140-150200.9.21.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP5-LTSS From an advisory covering 14 CVEs |
before 140.1.0-112.273.1 | 140.1.0-112.273.1 |
MozillaFirefoxSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 From an advisory covering 14 CVEs |
before 140.1.0-112.273.1 | 140.1.0-112.273.1 |
MozillaThunderbirdSUSE:Linux Enterprise Module for Package Hub 15 SP6 From an advisory covering 25 CVEs |
before 140.1.0-150200.8.230.1 | 140.1.0-150200.8.230.1 |
MozillaThunderbirdSUSE:Linux Enterprise Module for Package Hub 15 SP7 From an advisory covering 25 CVEs |
before 140.1.0-150200.8.230.1 | 140.1.0-150200.8.230.1 |
MozillaThunderbirdSUSE:Linux Enterprise Workstation Extension 15 SP6 From an advisory covering 25 CVEs |
before 140.1.0-150200.8.230.1 | 140.1.0-150200.8.230.1 |
MozillaThunderbirdSUSE:Linux Enterprise Workstation Extension 15 SP7 From an advisory covering 25 CVEs |
before 140.1.0-150200.8.230.1 | 140.1.0-150200.8.230.1 |
MozillaThunderbirdopenSUSE:Leap 15.6 From an advisory covering 25 CVEs |
before 140.1.0-150200.8.230.1 | 140.1.0-150200.8.230.1 |
mozjs52Ubuntu:18.04:LTS |
All versions, plus listed versions 52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1 |
None known |
mozjs38Ubuntu:18.04:LTS |
All versions, plus listed versions 38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4 |
None known |
mozjs68Ubuntu:20.04:LTS |
All versions, plus listed versions 68.5.0-1~fakesync68.5.0-2~fakesync68.6.0-168.6.0-1ubuntu1 |
None known |
mozjs52Ubuntu:20.04:LTS |
All versions, plus listed versions 52.9.1-1build152.9.1-1ubuntu3 |
None known |
mozjs102Ubuntu:22.04:LTS |
All versions, plus listed versions 102.11.0-0ubuntu0.22.04.1102.12.0-0ubuntu0.22.04.1102.13.0-0ubuntu0.22.04.1102.15.1-0ubuntu0.22.04.1 |
None known |
mozjs78Ubuntu:22.04:LTS |
All versions, plus listed versions 78.13.0-178.15.0-278.15.0-4ubuntu1 |
None known |
mozjs91Ubuntu:22.04:LTS |
All versions, plus listed versions 91.5.1-0ubuntu191.6.0-191.6.0-291.7.0-291.10.0-0ubuntu1 |
None known |
thunderbirdUbuntu:22.04:LTS |
before 1:140.7.1+build1-0ubuntu0.22.04.1, plus listed versions 1:91.1.2+build1-0ubuntu11:91.3.0+build2-0ubuntu11:91.3.1+build1-0ubuntu11:91.3.2+build1-0ubuntu11:91.4.0+build1.1-0ubuntu1 Show 33 moreShow less1:91.4.0+build2-0ubuntu11:91.5.0+build1-0ubuntu11:91.5.1+build1-0ubuntu11:91.6.1+build1-0ubuntu11:91.7.0+build1-0ubuntu11:91.7.0+build2-0ubuntu11:91.8.0+build2-0ubuntu11:91.9.1+build1-0ubuntu0.22.04.11:91.11.0+build2-0ubuntu0.22.04.11:102.2.2+build1-0ubuntu0.22.04.11:102.4.2+build2-0ubuntu0.22.04.11:102.7.1+build2-0ubuntu0.22.04.11:102.8.0+build2-0ubuntu0.22.04.11:102.9.0+build1-0ubuntu0.22.04.11:102.10.0+build2-0ubuntu0.22.04.11:102.11.0+build1-0ubuntu0.22.04.11:102.13.0+build1-0ubuntu0.22.04.11:102.15.0+build1-0ubuntu0.22.04.11:102.15.1+build1-0ubuntu0.22.04.11:115.3.1+build1-0ubuntu0.22.04.21:115.4.1+build1-0ubuntu0.22.04.11:115.5.0+build1-0ubuntu0.22.04.11:115.6.0+build2-0ubuntu0.22.04.11:115.8.1+build1-0ubuntu0.22.04.11:115.9.0+build1-0ubuntu0.22.04.11:115.10.1+build1-0ubuntu0.22.04.11:115.11.0+build2-0ubuntu0.22.04.11:115.12.0+build3-0ubuntu0.22.04.11:115.13.0+build5-0ubuntu0.22.04.11:115.15.0+build1-0ubuntu0.22.04.11:115.16.0+build2-0ubuntu0.22.04.11:115.18.0+build1-0ubuntu0.22.04.11:128.12.0+build1-0ubuntu0.22.04.1 |
1:140.7.1+build1-0ubuntu0.22.04.1 |
mozjs102Ubuntu:24.04:LTS |
All versions, plus listed versions 102.15.1-1102.15.1-3ubuntu2 |
None known |
mozjs115Ubuntu:24.04:LTS |
All versions, plus listed versions 115.3.0-0ubuntu1115.4.0-2115.5.0-1115.6.0-1115.7.0-4 Show 4 moreShow less115.8.0-1115.9.0-1115.9.0-1build1115.10.0-1 |
None known |
firefox-esropenSUSE:Tumbleweed From an advisory covering 22 CVEs |
before 140.1.0-1.1 | 140.1.0-1.1 |
MozillaThunderbirdopenSUSE:Tumbleweed From an advisory covering 20 CVEs |
before 140.1.0-1.1 | 140.1.0-1.1 |
MozillaFirefoxopenSUSE:Tumbleweed From an advisory covering 18 CVEs |
before 141.0-1.1 | 141.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-8039 is a high vulnerability (CVSS 8.1) in Mozilla Firefox, published July 22, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in thunderbird 1:140.7.1+build1-0ubuntu0.22.04.1.
References
bugzilla.mozilla.org/show_bug.cgi?id=1970997
mozilla.org/security/advisories/mfsa2025-56
nvd.nist.gov/vuln/detail/CVE-2025-8039
Show 59 moreShow less
github.com/advisories/GHSA-gg2x-qqv2-xfhc
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-2340
suse.com/support/update/announcement/2025/suse-su-202502529-1
bugzilla.suse.com/1237231
ubuntu.com/security/CVE-2025-8039
cve.org/CVERecord?id=CVE-2025-8039
Left out here: the rest of 1 source description. The JSON record has them.