{"schemaVersion":3,"id":"SUSE-SU-2025:02531-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for MozillaFirefox\n\nThis update for MozillaFirefox fixes the following issues:\n\n- Firefox Extended Support Release 140.1.0 ESR\n  * MFSA-RESERVE-2025-1968423 (bmo#1968423)\n    JavaScript engine only wrote partial return value to stack\n  * MFSA-RESERVE-2025-1971581 (bmo#1971581)\n    Large branch table could lead to truncated instruction\n  * MFSA-RESERVE-2025-1928021 (bmo#1928021)\n    CSP does not block javascript: URLs on object and embed tags\n  * MFSA-RESERVE-2025-1960834 (bmo#1960834)\n    DNS rebinding circumvents CORS\n  * MFSA-RESERVE-2025-1964767 (bmo#1964767)\n    Nameless cookies shadow secure cookies\n  * MFSA-RESERVE-2025-1968414 (bmo#1968414)\n    Potential user-assisted code execution in “Copy as cURL”\n    command\n  * MFSA-RESERVE-2025-1971719 (bmo#1971719)\n    Incorrect URL stripping in CSP reports\n  * MFSA-RESERVE-2025-1974407 (bmo#1974407)\n    XSLT documents could by-pass CSP\n  * MFSA-RESERVE-2025-1808979 (bmo#1808979)\n    CSP frame-src was not correctly enforced for paths\n  * MFSA-RESERVE-2025-1970997 (bmo#1970997)\n    Search terms persist in URL bar\n  * MFSA-RESERVE-2025-1973990 (bmo#1973990)\n    Incorrect JavaScript state machine for generators\n  * MFSA-RESERVE-2025-1 (bmo#1970422, bmo#1970422, bmo#1970422,\n    bmo#1970422)\n    Memory safety bugs fixed in Firefox ESR 115.26, Thunderbird\n    ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1,\n    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141\n  * MFSA-RESERVE-2025-2 (bmo#1975058, bmo#1975058, bmo#1975998,\n    bmo#1975998)\n    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird\n    ESR 140.1, Firefox 141 and Thunderbird 141\n  * MFSA-RESERVE-2025-3 (bmo#1975961, bmo#1975961, bmo#1975961)\n    Memory safety bugs fixed in Firefox ESR 128.13, Firefox ESR\n    140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141\n\nVarious security fixes MFSA 2025-59 (bsc#1246664):\n- CVE-2025-8027: JavaScript engine only wrote partial return value to stack\n- CVE-2025-8028: Large branch table could lead to truncated instruction\n- CVE-2025-8029: javascript: URLs executed on object and embed tags\n- CVE-2025-8036: DNS rebinding circumvents CORS\n- CVE-2025-8037: Nameless cookies shadow secure cookies\n- CVE-2025-8030: Potential user-assisted code execution in “Copy as cURL” command\n- CVE-2025-8031: Incorrect URL stripping in CSP reports\n- CVE-2025-8032: XSLT documents could bypass CSP\n- CVE-2025-8038: CSP frame-src was not correctly enforced for paths\n- CVE-2025-8039: Search terms persisted in URL bar\n- CVE-2025-8033: Incorrect JavaScript state machine for generators\n- CVE-2025-8034: Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141\n- CVE-2025-8040: Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141\n- CVE-2025-8035: Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141","dates":{"published":"2025-07-28T06:04:33.000Z","modified":"2026-02-04T02:24:45.735Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"suse","product":"MozillaFirefox&distro=SUSE Linux Enterprise Server 12 SP5-LTSS","name":"MozillaFirefox","label":"MozillaFirefox&distro=SUSE Linux Enterprise Server 12 SP5-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/MozillaFirefox&distro=SUSE Linux Enterprise Server 12 SP5-LTSS","purlType":"rpm","versions":[{"text":"< 140.1.0-112.273.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 140.1.0-112.273.1","eol":null,"hubHref":null},{"vendor":"suse","product":"MozillaFirefox&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5","name":"MozillaFirefox","label":"MozillaFirefox&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/MozillaFirefox&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5","purlType":"rpm","versions":[{"text":"< 140.1.0-112.273.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 140.1.0-112.273.1","eol":null,"hubHref":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502531-1/","label":"www.suse.com/support/update/announcement/2025/suse-su-202502531-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1246664","label":"bugzilla.suse.com/1246664","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8027","label":"www.suse.com/security/cve/CVE-2025-8027","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8028","label":"www.suse.com/security/cve/CVE-2025-8028","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8029","label":"www.suse.com/security/cve/CVE-2025-8029","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8030","label":"www.suse.com/security/cve/CVE-2025-8030","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8031","label":"www.suse.com/security/cve/CVE-2025-8031","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8032","label":"www.suse.com/security/cve/CVE-2025-8032","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8033","label":"www.suse.com/security/cve/CVE-2025-8033","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8034","label":"www.suse.com/security/cve/CVE-2025-8034","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8035","label":"www.suse.com/security/cve/CVE-2025-8035","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8036","label":"www.suse.com/security/cve/CVE-2025-8036","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8037","label":"www.suse.com/security/cve/CVE-2025-8037","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8038","label":"www.suse.com/security/cve/CVE-2025-8038","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8039","label":"www.suse.com/security/cve/CVE-2025-8039","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8040","label":"www.suse.com/security/cve/CVE-2025-8040","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2025-8027","CVE-2025-8028","CVE-2025-8029","CVE-2025-8030","CVE-2025-8031","CVE-2025-8032","CVE-2025-8033","CVE-2025-8034","CVE-2025-8035","CVE-2025-8036","CVE-2025-8037","CVE-2025-8038","CVE-2025-8039","CVE-2025-8040"],"downstream":[],"duplicates":[],"related":["CVE-2025-8027","CVE-2025-8028","CVE-2025-8029","CVE-2025-8030","CVE-2025-8031","CVE-2025-8032","CVE-2025-8033","CVE-2025-8034","CVE-2025-8035","CVE-2025-8036","CVE-2025-8037","CVE-2025-8038","CVE-2025-8039","CVE-2025-8040"]},"timeline":[{"kind":"published","date":"2025-07-28T06:04:33.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-02-04T02:24:45.735Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T15:06:36.606Z","stale":false,"partial":false}}