{"id":"CVE-2025-4920","aliases":["EUVD-2025-15601","GHSA-872r-h2cj-j272","openSUSE-SU-2025:15172-1"],"status":"rejected","title":"An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object....","description":"Duplicate of CVE-2025-4918","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2025-05-17T21:07:23Z","modified":"2026-03-23T04:53:27Z","affected":[{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mozjs128","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.10.1-1.1"}]}],"bundled":2}],"products":[{"vendor":"mozilla","product":"firefox"},{"vendor":"mozilla","product":"firefox esr"}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4920"},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1966612"},{"url":"https://www.mozilla.org/security/advisories/mfsa2025-36"},{"url":"https://www.mozilla.org/security/advisories/mfsa2025-37"},{"url":"https://github.com/advisories/GHSA-872r-h2cj-j272"},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4920","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4921","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-4920","description":"Duplicate of CVE-2025-4918","status":"rejected","published":"2025-05-17T21:07:23.879Z","modified":"2025-05-18T19:21:27.592Z","updated_at":"2026-11-02T14:32:48.512547Z"}],"euvd":[{"id":"EUVD-2025-15601","description":"Duplicate of CVE-2025-4918","status":"published","published":"2025-05-17T21:07:23Z","modified":"2025-05-18T19:21:27Z","updated_at":"2026-11-02T20:32:44.705403Z"}],"ghsa":[{"id":"GHSA-872r-h2cj-j272","title":"An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object....","description":"An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object. This vulnerability affects Firefox \u003c 138.0.4 and Firefox ESR \u003c 128.10.1.","status":"published","published":"2025-05-18T00:30:27Z","modified":"2025-05-18T00:30:34Z","updated_at":"2026-11-02T15:02:20.443164Z"}],"nvd":[{"id":"CVE-2025-4920","description":"Rejected reason: Duplicate of CVE-2025-4918","status":"rejected","published":"2025-05-17T22:15:19.753Z","modified":"2025-05-18T20:15:19.19Z","updated_at":"2026-11-02T14:11:08.321805Z"}],"osv":[{"id":"openSUSE-SU-2025:15172-1","title":"libmozjs-128-0-128.10.1-1.1 on GA media","description":"These are all security issues fixed in the libmozjs-128-0-128.10.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-27T00:00:00Z","modified":"2026-03-23T04:53:27.220166Z","updated_at":"2026-11-02T16:58:37.399567Z"}]}}