kritisch
CVE-2025-1009
firefox: thunderbird: Use-after-free in XSLT
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut Red Hat (hoch), AlmaLinux (hoch), Amazon (hoch), Oracle (hoch), Rocky Linux (hoch), Ubuntu (mittel).
Beschreibung
An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| alma 8 | firefox, thunderbird | 128.7.0-1.el8_10 und 1 weitere |
| alma 9 | firefox, firefox-x11, thunderbird | 128.7.0-1.el9_5 und 1 weitere |
| amazon linux 2 | thunderbird, thunderbird-debuginfo | 128.7.0-1.amzn2.0.2 |
| chainguard | firefox, firefox-esr | 135.0-r0 und 1 weitere |
| debian 11 | firefox-esr, thunderbird | 128.7.0esr-1~deb11u1 und 1 weitere |
| debian 12 | firefox-esr, thunderbird | 128.7.0esr-1~deb12u1 und 1 weitere |
| debian 13 | firefox-esr, thunderbird | 128.7.0esr-1 und 1 weitere |
| debian 14 | firefox-esr, thunderbird | 128.7.0esr-1 und 1 weitere |
| echo | firefox-esr, thunderbird | 128.7.0esr-1~deb12u1 und 1 weitere |
| Oracle Linux 7 | firefox | 128.7.0-1.0.1.el7_9 |
| Oracle Linux 8 | firefox, thunderbird | 128.7.0-1.0.1.el8_10 |
| Oracle Linux 9 | firefox, firefox-x11, thunderbird | 128.7.0-1.0.1.el9_5 |
Alle 50 Einträge aus 29 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| alma 8 | firefox | 128.7.0-1.el8_10 |
| alma 8 | thunderbird | 128.7.0-1.el8_10.alma.1 |
| alma 9 | firefox | 128.7.0-1.el9_5 |
| alma 9 | firefox-x11 | 128.7.0-1.el9_5 |
| alma 9 | thunderbird | 128.7.0-1.el9_5.alma.1 |
| amazon linux 2 | thunderbird | 128.7.0-1.amzn2.0.2 |
| amazon linux 2 | thunderbird-debuginfo | 128.7.0-1.amzn2.0.2 |
| chainguard | firefox | 135.0-r0 |
| chainguard | firefox-esr | 128.7.0-r0 |
| debian 11 | firefox-esr | 128.7.0esr-1~deb11u1 |
| debian 11 | thunderbird | 1:128.7.0esr-1~deb11u1 |
| debian 12 | firefox-esr | 128.7.0esr-1~deb12u1 |
| debian 12 | thunderbird | 1:128.7.0esr-1~deb12u1 |
| debian 13 | firefox-esr | 128.7.0esr-1 |
| debian 13 | thunderbird | 1:128.7.0esr-1 |
| debian 14 | firefox-esr | 128.7.0esr-1 |
| debian 14 | thunderbird | 1:128.7.0esr-1 |
| echo | firefox-esr | 128.7.0esr-1~deb12u1 |
| echo | thunderbird | 1:128.7.0esr-1~deb12u1 |
| Oracle Linux 7 | firefox | 128.7.0-1.0.1.el7_9 |
| Oracle Linux 8 | firefox | 128.7.0-1.0.1.el8_10 |
| Oracle Linux 8 | thunderbird | 128.7.0-1.0.1.el8_10 |
| Oracle Linux 9 | firefox | 128.7.0-1.0.1.el9_5 |
| Oracle Linux 9 | firefox-x11 | 128.7.0-1.0.1.el9_5 |
| Oracle Linux 9 | thunderbird | 128.7.0-1.0.1.el9_5 |
| rapidfort alma 10 | firefox | kein Fix angegeben |
| rapidfort alpine 3.20 | thunderbird | 128.7.0-r0 |
| rapidfort alpine 3.21 | thunderbird | 128.7.0-r0 |
| rapidfort alpine 3.23 | thunderbird | 128.7.0-r0 |
| rapidfort alpine 3.24 | thunderbird | 128.7.0-r0 |
| rapidfort debian 12 | firefox-esr | 0:128.7.0esr-1, 0:128.7.0esr-1~deb11u1, 0:128.7.0esr-1~deb12u1 |
| rapidfort debian 12 | thunderbird | 0:128.7.0esr-1~deb11u1, 0:128.7.0esr-1~deb12u1, 1:128.7.0esr-1 |
| rapidfort debian 13 | firefox-esr | 0:128.7.0esr-1, 0:128.7.0esr-1~deb11u1, 0:128.7.0esr-1~deb12u1 |
| rapidfort debian 13 | thunderbird | 0:128.7.0esr-1~deb11u1, 0:128.7.0esr-1~deb12u1, 1:128.7.0esr-1 |
| rapidfort Oracle Linux 10 | firefox | kein Fix angegeben |
| rapidfort Oracle Linux 9 | firefox | 0:128.7.0-1.0.1.el9_5 |
| rapidfort Oracle Linux 9 | firefox-x11 | 0:128.7.0-1.0.1.el9_5 |
| rapidfort Oracle Linux 9 | thunderbird | 0:128.7.0-1.0.1.el9_5 |
| rapidfort ubuntu 20.04 | thunderbird | 1:140.7.1+build1-0ubuntu0.22.04.1 |
| rapidfort ubuntu 22.04 | thunderbird | 1:140.7.1+build1-0ubuntu0.22.04.1 |
| rapidfort ubuntu 24.04 | thunderbird | 1:140.7.1+build1-0ubuntu0.22.04.1 |
| Red Hat | firefox | kein Fix angegeben |
| Red Hat | firefox-flatpak-container | kein Fix angegeben |
| Red Hat | thunderbird | kein Fix angegeben |
| Red Hat | thunderbird-flatpak-container | kein Fix angegeben |
| rocky 8 | firefox | 128.7.0-1.el8_10 |
| rocky 8 | thunderbird | 128.7.0-1.el8_10 |
| ubuntu 20.04 | firefox | 135.0+build2-0ubuntu0.20.04.1 |
| ubuntu 22.04 | thunderbird | 1:128.12.0+build1-0ubuntu0.22.04.1 |
| wolfi | firefox | 135.0-r0 |
Referenzen
- https://access.redhat.com/errata/RHSA-2025:1184
- https://access.redhat.com/errata/RHSA-2025:1292
- https://access.redhat.com/security/cve/CVE-2025-1009
- https://bugzilla.mozilla.org/show_bug.cgi?id=1936613
- https://bugzilla.redhat.com/2343748
- https://bugzilla.redhat.com/2343750
- https://bugzilla.redhat.com/2343752
- https://bugzilla.redhat.com/2343754
Alle 53 Referenzen
- https://bugzilla.redhat.com/2343756
- https://bugzilla.redhat.com/2343759
- https://bugzilla.redhat.com/2343760
- https://bugzilla.redhat.com/2343762
- https://bugzilla.redhat.com/2343764
- https://bugzilla.redhat.com/2343765
- https://bugzilla.redhat.com/show_bug.cgi?id=2343748
- https://bugzilla.redhat.com/show_bug.cgi?id=2343750
- https://bugzilla.redhat.com/show_bug.cgi?id=2343752
- https://bugzilla.redhat.com/show_bug.cgi?id=2343754
- https://bugzilla.redhat.com/show_bug.cgi?id=2343756
- https://bugzilla.redhat.com/show_bug.cgi?id=2343759
- https://bugzilla.redhat.com/show_bug.cgi?id=2343760
- https://bugzilla.redhat.com/show_bug.cgi?id=2343762
- https://bugzilla.redhat.com/show_bug.cgi?id=2343764
- https://bugzilla.redhat.com/show_bug.cgi?id=2343765
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0510
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1009
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1010
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1011
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1012
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1013
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1014
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1015
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1016
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1017
- https://errata.almalinux.org/9/ALSA-2025-1184.html
- https://errata.rockylinux.org/RLSA-2025:1292
- https://linux.oracle.com/cve/CVE-2025-1009.html
- https://linux.oracle.com/errata/ELSA-2025-1292.html
- https://lists.debian.org/debian-lts-announce/2025/02/msg00005.html
- https://lists.debian.org/debian-lts-announce/2025/02/msg00006.html
- https://nvd.nist.gov/vuln/detail/CVE-2025-1009
- https://ubuntu.com/security/notices/USN-7263-1
- https://ubuntu.com/security/notices/USN-7663-1
- https://www.cve.org/CVERecord?id=CVE-2025-1009
- https://www.mozilla.org/en-US/security/advisories/mfsa2025-07/#CVE-2025-1009
- https://www.mozilla.org/en-US/security/advisories/mfsa2025-09/#CVE-2025-1009
- https://www.mozilla.org/en-US/security/advisories/mfsa2025-10/#CVE-2025-1009
- https://www.mozilla.org/security/advisories/mfsa2025-07/
- https://www.mozilla.org/security/advisories/mfsa2025-08/
- https://www.mozilla.org/security/advisories/mfsa2025-09/
- https://www.mozilla.org/security/advisories/mfsa2025-10/
- https://www.mozilla.org/security/advisories/mfsa2025-11/