{"schemaVersion":3,"id":"SUSE-SU-2025:21170-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for mozjs128\n\nThis update for mozjs128 fixes the following issues:\n\n- Update to version 128.14.0 (bsc#1248162):\n  + CVE-2025-9179: Sandbox escape due to invalid pointer in the\n    Audio/Video: GMP component\n  + CVE-2025-9180: Same-origin policy bypass in the Graphics:\n    Canvas2D component\n  + CVE-2025-9181: Uninitialized memory in the JavaScript Engine\n    component\n  + CVE-2025-9185: Memory safety bugs fixed in Firefox ESR 115.27,\n    Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2,\n    Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142\n\n- Update to version 128.13.0:\n  + CVE-2025-8027: JavaScript engine only wrote partial return\n    value to stack\n  + CVE-2025-8028: Large branch table could lead to truncated\n    instruction\n  + CVE-2025-8029: javascript: URLs executed on object and embed\n    tags\n  + CVE-2025-8030: Potential user-assisted code execution in “Copy\n    as cURL” command\n  + CVE-2025-8031: Incorrect URL stripping in CSP reports\n  + CVE-2025-8032: XSLT documents could bypass CSP\n  + CVE-2025-8033: Incorrect JavaScript state machine for\n    generators\n  + CVE-2025-8034: Memory safety bugs fixed in Firefox ESR 115.26,\n    Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,\n    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141\n  + CVE-2025-8035: Memory safety bugs fixed in Firefox ESR 128.13,\n    Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR\n    140.1, Firefox 141 and Thunderbird 141\n\n- Update to version 128.12.0:\n  + CVE-2025-6424: Use-after-free in FontFaceSet\n  + CVE-2025-6425: The WebCompat WebExtension shipped with Firefox\n    exposed a persistent UUID\n  + CVE-2025-6426: No warning when opening executable terminal\n    files on macOS\n  + CVE-2025-6429: Incorrect parsing of URLs could have allowed\n    embedding of youtube.com\n  + CVE-2025-6430: Content-Disposition header ignored when a file\n    is included in an embed or object tag\n\n- Update to version 128.11.0:\n  + CVE-2025-5283: Double-free in libvpx encoder\n  + CVE-2025-5263: Error handling for script execution was\n    incorrectly isolated from web content\n  + CVE-2025-5264: Potential local code execution in “Copy as cURL”\n    command\n  + CVE-2025-5265: Potential local code execution in “Copy as cURL”\n    command\n  + CVE-2025-5266: Script element events leaked cross-origin\n    resource status\n  + CVE-2025-5267: Clickjacking vulnerability could have led to\n    leaking saved payment card details\n  + CVE-2025-5268: Memory safety bugs fixed in Firefox 139,\n    Thunderbird 139, Firefox ESR 128.11, and Thunderbird 128.11\n  + CVE-2025-5269: Memory safety bug fixed in Firefox ESR 128.11\n    and Thunderbird 128.11","dates":{"published":"2025-12-03T20:38:36.000Z","modified":"2026-03-23T04:49:17.541Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"suse","product":"mozjs128&distro=SUSE Linux Enterprise Server 16.0","name":"mozjs128","label":"mozjs128&distro=SUSE Linux Enterprise Server 16.0","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/mozjs128&distro=SUSE Linux Enterprise Server 16.0","purlType":"rpm","versions":[{"text":"< 128.14.0-160000.1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 128.14.0-160000.1.1","eol":null,"hubHref":null},{"vendor":"suse","product":"mozjs128&distro=SUSE Linux Enterprise Server for SAP applications 16.0","name":"mozjs128","label":"mozjs128&distro=SUSE Linux Enterprise Server for SAP applications 16.0","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/mozjs128&distro=SUSE Linux Enterprise Server for SAP applications 16.0","purlType":"rpm","versions":[{"text":"< 128.14.0-160000.1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 128.14.0-160000.1.1","eol":null,"hubHref":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202521170-1/","label":"www.suse.com/support/update/announcement/2025/suse-su-202521170-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1248162","label":"bugzilla.suse.com/1248162","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5263","label":"www.suse.com/security/cve/CVE-2025-5263","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5264","label":"www.suse.com/security/cve/CVE-2025-5264","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5265","label":"www.suse.com/security/cve/CVE-2025-5265","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5266","label":"www.suse.com/security/cve/CVE-2025-5266","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5267","label":"www.suse.com/security/cve/CVE-2025-5267","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5268","label":"www.suse.com/security/cve/CVE-2025-5268","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5269","label":"www.suse.com/security/cve/CVE-2025-5269","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5283","label":"www.suse.com/security/cve/CVE-2025-5283","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6424","label":"www.suse.com/security/cve/CVE-2025-6424","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6425","label":"www.suse.com/security/cve/CVE-2025-6425","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6426","label":"www.suse.com/security/cve/CVE-2025-6426","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6429","label":"www.suse.com/security/cve/CVE-2025-6429","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6430","label":"www.suse.com/security/cve/CVE-2025-6430","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8027","label":"www.suse.com/security/cve/CVE-2025-8027","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8028","label":"www.suse.com/security/cve/CVE-2025-8028","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8029","label":"www.suse.com/security/cve/CVE-2025-8029","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8030","label":"www.suse.com/security/cve/CVE-2025-8030","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8031","label":"www.suse.com/security/cve/CVE-2025-8031","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8032","label":"www.suse.com/security/cve/CVE-2025-8032","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8033","label":"www.suse.com/security/cve/CVE-2025-8033","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8034","label":"www.suse.com/security/cve/CVE-2025-8034","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8035","label":"www.suse.com/security/cve/CVE-2025-8035","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9179","label":"www.suse.com/security/cve/CVE-2025-9179","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9180","label":"www.suse.com/security/cve/CVE-2025-9180","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9181","label":"www.suse.com/security/cve/CVE-2025-9181","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9185","label":"www.suse.com/security/cve/CVE-2025-9185","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2025-5263","CVE-2025-5264","CVE-2025-5265","CVE-2025-5266","CVE-2025-5267","CVE-2025-5268","CVE-2025-5269","CVE-2025-5283","CVE-2025-6424","CVE-2025-6425","CVE-2025-6426","CVE-2025-6429","CVE-2025-6430","CVE-2025-8027","CVE-2025-8028","CVE-2025-8029","CVE-2025-8030","CVE-2025-8031","CVE-2025-8032","CVE-2025-8033","CVE-2025-8034","CVE-2025-8035","CVE-2025-9179","CVE-2025-9180","CVE-2025-9181","CVE-2025-9185"],"downstream":[],"duplicates":[],"related":["CVE-2025-5263","CVE-2025-5264","CVE-2025-5265","CVE-2025-5266","CVE-2025-5267","CVE-2025-5268","CVE-2025-5269","CVE-2025-5283","CVE-2025-6424","CVE-2025-6425","CVE-2025-6426","CVE-2025-6429","CVE-2025-6430","CVE-2025-8027","CVE-2025-8028","CVE-2025-8029","CVE-2025-8030","CVE-2025-8031","CVE-2025-8032","CVE-2025-8033","CVE-2025-8034","CVE-2025-8035","CVE-2025-9179","CVE-2025-9180","CVE-2025-9181","CVE-2025-9185"]},"timeline":[{"kind":"published","date":"2025-12-03T20:38:36.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-03-23T04:49:17.541Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T20:50:20.340Z","stale":false,"partial":false}}