MGASA-2025-0045: firefox Mageia
CVSS: UnknownPublished
Published 09-02-2025Last modified 16-04-2026
Vulnerability summary
MGASA-2025-0045 is a vulnerability in firefox Mageia with no CVSS score yet.
CVSS score
Not scored
010
No CVSS score recordedEPSS score
Not scored
0%100%
No EPSS score yetKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 9 · Downstream 0Timeline
- 09-02-2025PublishedVulnerability first disclosed.
- 16-04-2026Last modifiedVulnerability information updated.
Description
Updated rootcerts, nss & firefox packages fix security vulnerabilities Use-after-free in XSLT. (CVE-2025-1009) Use-after-free in Custom Highlight. (CVE-2025-1010) A bug in WebAssembly code generation could result in a crash. (CVE-2025-1011) Use-after-free during concurrent delazification. (CVE-2025-1012) Potential double-free vulnerability in PKCS#7 decryption handling. (CVE-2024-11704) Potential opening of private browsing tabs in normal browsing windows. (CVE-2025-1013) Certificate length was not properly checked. (CVE-2025-1014) Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20, and Thunderbird 128.7. (CVE-2025-1016) Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7. (CVE-2025-1017)
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Mageia4 products
- firefox< 128.7.0-1.mga9
- firefox-l10n< 128.7.0-1.mga9
- nss< 3.108.0-1.mga9
- rootcerts< 20250130.00-1.mga9
1 vendor · 4 products
References
5 linksRelated vulnerabilities
MGASA-2026-0441mageiafirefox+5Updated nss & firefox packages fix security vulnerabilities
Use-after-free in the Audio/Video: Web Codecs component.
(CVE-2026-92005)
Privilege escalation due to incorrect boundary conditions in the
Graphics: CanvasWebGL component. (CVE-2026-92006)
Privilege escalation due to incorrect boundary conditions in the
Graphics: CanvasWebGL component. (CVE-2026-92007)
Privilege escalation due to incorrect boundary conditions in the
Graphics: CanvasWebGL component. (CVE-2026-92008)
Privilege escalation due to incorrect boundary conditions in the
Graphics: CanvasWebGL component. (CVE-2026-92009)
Privilege escalation due to incorrect boundary conditions in the
Graphics: CanvasWebGL component. (CVE-2026-92010)
Privilege escalation due to incorrect boundary conditions in the
Graphics: CanvasWebGL component. (CVE-2026-92011)
Privilege escalation due to incorrect boundary conditions in the
Graphics: CanvasWebGL component. (CVE-2026-92012)
Privilege escalation due to incorrect boundary conditions in the
Graphics: CanvasWebGL component. (CVE-2026-92013)
Privilege escalation due to incorrect boundary conditions in the
Graphics component. (CVE-2026-92014)
Privilege escalation in the WebExtensions component. (CVE-2026-92015)
Use-after-free in the Disability Access APIs component. (CVE-2026-92016)
Privilege escalation in the DOM: Service Workers component.
(CVE-2026-92017)
Sandbox escape in the DOM: Core & HTML component. (CVE-2026-92018)
Mitigation bypass in the Remote Settings Client component.
(CVE-2026-92019)
Privilege escalation due to incorrect boundary conditions in the
Graphics: WebRender component. (CVE-2026-92020)
Use-after-free in the JavaScript Engine: JIT component. (CVE-2026-92021)
Use-after-free in the DOM: HTML Parser component. (CVE-2026-92022)
Use-after-free in the XML component. (CVE-2026-92023)
Use-after-free in the SVG component. (CVE-2026-92024)
Use-after-free in the DOM: Navigation component. (CVE-2026-92025)
Use-after-free in the Networking component. (CVE-2026-92026)
Use-after-free in the DOM: Streams component. (CVE-2026-92027)
Use-after-free in the DOM: Core & HTML component. (CVE-2026-92028)
Use-after-free in the SVG component. (CVE-2026-92029)
Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component.
(CVE-2026-92030)
Information disclosure in the Graphics: ImageLib component.
(CVE-2026-92031)
Sandbox escape due to invalid pointer in the Graphics component.
(CVE-2026-92032)
Mitigation bypass in the Remote Settings Client component.
(CVE-2026-92038)
Mitigation bypass in the DOM: Notifications component. (CVE-2026-92039)
Mitigation bypass in the DOM: Networking component. (CVE-2026-92041)
Race condition in the DOM: Content Processes component. (CVE-2026-92042)
Privilege escalation due to incorrect boundary conditions in the
Audio/Video component. (CVE-2026-92043)
Information disclosure in the Networking: HTTP component.
(CVE-2026-92044)
Sandbox escape due to incorrect boundary conditions in the WebRTC
component. (CVE-2026-92045)
Use-after-free in the Graphics component. (CVE-2026-92046)
Privilege escalation in the Crash Reporting component. (CVE-2026-92047)
Privilege escalation due to uninitialized memory in the Graphics:
CanvasWebGL component. (CVE-2026-92052)
Privilege escalation in the Graphics: CanvasWebGL component.
(CVE-2026-92053)
Privilege escalation in the Memory component. (CVE-2026-92054)
Privilege escalation in the DevTools component. (CVE-2026-92055)
Use-after-free in the Graphics: Text component. (CVE-2026-92056)
Mitigation bypass in the Enterprise Policies component. (CVE-2026-92057)
Use-after-free in the Graphics component. (CVE-2026-92058)
Incorrect boundary conditions in the DOM: Editor component.
(CVE-2026-92059)
Use-after-free in the Internationalization component. (CVE-2026-92060)
Privilege escalation in the Session Restore component. (CVE-2026-92062)
Use-after-free in the Widget: Gtk component. (CVE-2026-92067)
Site isolation issue in the Reader Mode component. (CVE-2026-92068)
Spoofing issue in the DOM: Navigation component. (CVE-2026-92069)
Information disclosure in the Networking component. (CVE-2026-92070)
Incorrect boundary conditions in the Safe Browsing component.
(CVE-2026-92072)
Privilege escalation in the Enterprise Policies component.
(CVE-2026-92073)
Mitigation bypass in the Popup Blocker component. (CVE-2026-92074)
Mitigation bypass in the Networking component. (CVE-2026-92075)
Incorrect boundary conditions in the Networking component.
(CVE-2026-92076)
Denial-of-service in the SVG component. (CVE-2026-92077)
Denial-of-service in the Security component. (CVE-2026-92078)MGASA-2026-0387mageiafirefox+5Updated firefox & nss packages fix security vulnerabilities
Sandbox escape in the Remote Settings Client component. (CVE-2026-75874)
Privilege escalation in the DOM: Workers component. (CVE-2026-16365)
Use-after-free in the JavaScript: GC component. (CVE-2026-84118)
Sandbox escape due to use-after-free in the DOM: Navigation component.
(CVE-2026-84119)
Use-after-free in the Audio/Video component. (CVE-2026-84120)
Sandbox escape due to use-after-free in the DOM: Security component.
(CVE-2026-84121)
Use-after-free in the Audio/Video component. (CVE-2026-84122)
Privilege escalation due to use-after-free in the Graphics: WebGPU
component. (CVE-2026-84123)
Use-after-free in the DOM: Core & HTML component. (CVE-2026-84124)
Use-after-free in the DOM: Core & HTML component. (CVE-2026-84125)
Privilege escalation in the DOM: Navigation component. (CVE-2026-16371)
Privilege escalation in the Application Update component.
(CVE-2026-74952)
Site isolation issue in the DOM: Navigation component. (CVE-2026-84129)
Information disclosure in the Graphics: WebGPU component.
(CVE-2026-84130)
Privilege escalation due to invalid pointer in the Graphics component.
(CVE-2026-84131)
Information disclosure in the Networking: HTTP component.
(CVE-2026-84132)
Site isolation issue in the DOM: Push Subscriptions component.
(CVE-2026-84133)
Other issue in the Profile Backup component. (CVE-2026-84134)
Other issue in the DOM: Navigation component. (CVE-2026-84136)
Spoofing issue in the DOM: Core & HTML component. (CVE-2026-84137)
Clickjacking issue in the DOM: Events component. (CVE-2026-84139)
Site isolation issue in the DOM: Navigation component. (CVE-2026-84140)
Integer overflow in the Graphics: ImageLib component. (CVE-2026-84141)
Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and
Firefox ESR 140.15. (CVE-2026-84143)
Internally found bugs fixed in Firefox 155 and Firefox ESR 153.2.
(CVE-2026-84144)
Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox
ESR 140.15 and Firefox ESR 115.40. (CVE-2026-84145)MGASA-2026-0345mageiafirefox+7Updated nspr, nss, & firefox packages fix security vulnerabilities
Site isolation issue in the Graphics: CanvasWebGL component.
(CVE-2026-74934)
Privilege escalation in the DOM: Networking component. (CVE-2026-74935)
Use-after-free in the JavaScript: WebAssembly component.
(CVE-2026-74936)
Use-after-free in the JavaScript: GC component. (CVE-2026-74937)
Mitigation bypass in the JavaScript: GC component. (CVE-2026-74938)
Privilege escalation in the DOM: Navigation component. (CVE-2026-74939)
Use-after-free in the Graphics: Text component. (CVE-2026-74940)
Privilege escalation in the Graphics: CanvasWebGL component.
(CVE-2026-74941)
Privilege escalation in the Remote Settings Client component.
(CVE-2026-74942)
Use-after-free in the Graphics: ImageLib component. (CVE-2026-74943)
Use-after-free in the DOM: Core & HTML component. (CVE-2026-74944)
Information disclosure in the Graphics: Text component. (CVE-2026-74945)
Privilege escalation due to incorrect boundary conditions in the
Graphics: CanvasWebGL component. (CVE-2026-74946)
Privilege escalation due to invalid pointer in the Graphics component.
(CVE-2026-74947)
Information disclosure in the Graphics component. (CVE-2026-74948)
Privilege escalation in the Downloads API component. (CVE-2026-74950)
Privilege escalation in the Networking: Cookies component.
(CVE-2026-74953)
Information disclosure due to side-channel in the Storage: Cache API
component. (CVE-2026-74954)
Privilege escalation in the Request Handling component. (CVE-2026-74955)
Same-origin policy bypass in the DOM: Service Workers component.
(CVE-2026-74956)
Mitigation bypass in the Safe Browsing component. (CVE-2026-74957)
Information disclosure in the WebRTC component. (CVE-2026-74958)
Mitigation bypass in the Storage: Cache API component. (CVE-2026-74959)
Site isolation issue in the WebExtensions component. (CVE-2026-74960)
Side-channel in the Web Audio component. (CVE-2026-74961)
Site isolation issue in the Networking: Cookies component.
(CVE-2026-74962)
Same-origin policy bypass in the Networking: Cookies component.
(CVE-2026-74963)
Integer overflow in the Graphics component. (CVE-2026-74964)
Privilege escalation in the Shell Integration component.
(CVE-2026-74965)
Information disclosure in the Form Autofill component. (CVE-2026-74966)
Same-origin policy bypass in the Audio/Video: Playback component.
(CVE-2026-74967)
Site isolation issue in the Graphics: WebRender component.
(CVE-2026-74968)
Use-after-free in the Layout: Text and Fonts component. (CVE-2026-74969)
Site isolation issue in the Graphics component. (CVE-2026-74970)
Information disclosure in the DOM: UI Events & Focus Handling component.
(CVE-2026-74971)
Information disclosure in the DOM: Push Subscriptions component.
(CVE-2026-74972)
Use-after-free in the Graphics: Canvas2D component. (CVE-2026-74949)
Race condition, use-after-free in the Graphics component.
(CVE-2026-74973)
Same-origin policy bypass in the Graphics: ImageLib component.
(CVE-2026-74974)
JIT miscompilation in the JavaScript Engine: JIT component.
(CVE-2026-74976)
Integer overflow in the Graphics component. (CVE-2026-74977)
Clickjacking issue in the Widget component. (CVE-2026-74978)
Mitigation bypass in the Add-ons Manager component. (CVE-2026-74979)
Site isolation issue in the Audio/Video: Web Codecs component.
(CVE-2026-74981)
Denial-of-service in the Widget component. (CVE-2026-74982)
Mitigation bypass in the Data Loss Prevention component.
(CVE-2026-74983)
Race condition in the JavaScript Engine component. (CVE-2026-74984)
Privilege escalation in the Enterprise Policies component.
(CVE-2026-74985)
Site isolation issue in the CSS Parsing and Computation component.
(CVE-2026-74986)
Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and
Firefox 154. (CVE-2026-74987)
Internally found bugs fixed in Firefox ESR 153.1 and Firefox 154.
(CVE-2026-74988)
Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and
Firefox 154. (CVE-2026-74990)MGASA-2026-0325mageiafirefox+7Updated rootcerts, nss & firefox packages fix security vulnerabilities
Updated rootcerts, nss & firefox packages fixes various vulnerabilities.
Please see the links for detailed information of each one.MGASA-2026-0242mageiafirefox+7Updated firefox, firefox-l10n, rootcerts, nss packages fix security vulnerabilities
The updated packages fix security vulnerabilities:
Privilege escalation in the Graphics: WebRender component.
(CVE-2026-12289)
Memory safety bug fixed in Firefox ESR 140.12. (CVE-2026-12290)
Use-after-free in the Networking: HTTP component. (CVE-2026-12291)
Incorrect boundary conditions in the Web Audio component.
(CVE-2026-12292)
Sandbox escape in the DOM: Workers component. (CVE-2026-12294)
Sandbox escape in the DOM: Navigation component. (CVE-2026-12295)
Memory safety bug fixed in Firefox ESR 140.12. (CVE-2026-12298)
Sandbox escape in the Security: Process Sandboxing component.
(CVE-2026-12296)
Sandbox escape due to incorrect boundary conditions in the Networking
component. (CVE-2026-12297)
JIT miscompilation in the DOM: Core & HTML component. (CVE-2026-12299)
Memory safety bug fixed in Firefox ESR 140.12. (CVE-2026-12329)
Mitigation bypass in the DOM: Security component. (CVE-2026-12302)
Same-origin policy bypass in the Networking: Cookies component.
(CVE-2026-12304)
Memory safety bug fixed in Firefox ESR 140.12. (CVE-2026-12305)
Memory safety bug fixed in Firefox ESR 140.12. (CVE-2026-12306)
Memory safety bug fixed in Firefox ESR 140.12. (CVE-2026-12307)
Memory safety bug fixed in Firefox ESR 140.12. (CVE-2026-12308)
Memory safety bug fixed in Firefox ESR 140.12. (CVE-2026-12309)
Memory safety bug fixed in Firefox ESR 140.12. (CVE-2026-12310)
Information disclosure, sandbox escape in the Security: Process
Sandboxing component. (CVE-2026-12311)
Memory safety bug fixed in Firefox ESR 140.12. (CVE-2026-12312)
Information disclosure, sandbox escape in the Security: Process
Sandboxing component. (CVE-2026-12313)
Memory safety bug fixed in Firefox ESR 140.12. (CVE-2026-12314)
Mitigation bypass in the DOM: Security component. (CVE-2026-12315)
Incorrect boundary conditions in the Internationalization component.
(CVE-2026-12330)
Incorrect boundary conditions in the Graphics: CanvasWebGL component.
(CVE-2026-12324)
Denial-of-service in the Graphics: ImageLib component. (CVE-2026-12325)
Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12,
Firefox 152 and Thunderbird 152. (CVE-2026-12327)
Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12,
Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152.
(CVE-2026-12328)MGASA-2026-0165mageiafirefox+3Updated nspr, nss and firefox(-l10n) packages fix security issues
The updated packages fix security vulnerabilities:
Incorrect boundary conditions in the Audio/Video: Web Codecs component.
(CVE-2026-8946)
Incorrect boundary conditions in the JavaScript Engine: JIT component.
(CVE-2026-8388)
Use-after-free in the DOM: Bindings (WebIDL) component. (CVE-2026-8947)
Other issue in the JavaScript Engine component. (CVE-2026-8391)
Sandbox escape in the Profile Backup component. (CVE-2026-8401)
Same-origin policy bypass in the Networking: HTTP component.
(CVE-2026-8950)
Sandbox escape due to use-after-free in the Disability Access APIs
component. (CVE-2026-8953)
Incorrect boundary conditions, integer overflow in the Audio/Video
component. (CVE-2026-8954)
Privilege escalation in the DOM: Workers component. (CVE-2026-8955)
Integer overflow in the Networking: JAR component. (CVE-2026-8956)
Privilege escalation in the Enterprise Policies component.
(CVE-2026-8957)
Information disclosure, sandbox escape in the Security: Process
Sandboxing component. (CVE-2026-8958)
Spoofing issue in the Form Autofill component. (CVE-2026-8961)
Mitigation bypass in the DOM: Security component. (CVE-2026-8962)
Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs
component. (CVE-2026-8968)
Privilege escalation in the Security component. (CVE-2026-8970)
Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151.
(CVE-2026-8974)
Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and
Firefox 151. (CVE-2026-8975)