crítica
CVE-2025-14330
firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según AlmaLinux (alta), Amazon (alta), Oracle (alta), Rocky Linux (alta), Red Hat (media), Ubuntu (media).
Descripción
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| alma 8 | firefox, thunderbird | 140.6.0-1.el8_10.alma.1 |
| alma 9 | firefox, firefox-x11, thunderbird | 140.6.0-1.el9_7.alma.1 |
| amazon linux 2 | thunderbird | 140.6.0-1.amzn2.0.1 |
| amazon linux 2023 | firefox, firefox-debuginfo, firefox-debugsource | 140.6.0-1.amzn2023.0.1 |
| chainguard | firefox, firefox-esr | 140.6-r0 |
| debian 11 | firefox-esr, thunderbird | 140.6.0esr-1~deb11u1 y 1 más |
| debian 12 | firefox-esr, thunderbird | 140.6.0esr-1~deb12u1 y 1 más |
| debian 13 | firefox-esr, thunderbird | 140.6.0esr-1~deb13u1 y 1 más |
| debian 14 | firefox-esr, thunderbird | 140.6.0esr-1 y 1 más |
| echo | firefox-esr, thunderbird | 140.6.0esr-1~deb12u1 y 1 más |
| Oracle Linux 7 | firefox | 140.6.0-1.0.1.el7_9 |
| Oracle Linux 8 | firefox, thunderbird | 140.6.0-1.0.1.el8_10 |
Mostrar las 61 entradas de 30 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| alma 8 | firefox | 140.6.0-1.el8_10.alma.1 |
| alma 8 | thunderbird | 140.6.0-1.el8_10.alma.1 |
| alma 9 | firefox | 140.6.0-1.el9_7.alma.1 |
| alma 9 | firefox-x11 | 140.6.0-1.el9_7.alma.1 |
| alma 9 | thunderbird | 140.6.0-1.el9_7.alma.1 |
| amazon linux 2 | thunderbird | 140.6.0-1.amzn2.0.1 |
| amazon linux 2023 | firefox | 140.6.0-1.amzn2023.0.1 |
| amazon linux 2023 | firefox-debuginfo | 140.6.0-1.amzn2023.0.1 |
| amazon linux 2023 | firefox-debugsource | 140.6.0-1.amzn2023.0.1 |
| chainguard | firefox | 140.6-r0 |
| chainguard | firefox-esr | 140.6-r0 |
| debian 11 | firefox-esr | 140.6.0esr-1~deb11u1 |
| debian 11 | thunderbird | 1:140.6.0esr-1~deb11u1 |
| debian 12 | firefox-esr | 140.6.0esr-1~deb12u1 |
| debian 12 | thunderbird | 1:140.6.0esr-1~deb12u1 |
| debian 13 | firefox-esr | 140.6.0esr-1~deb13u1 |
| debian 13 | thunderbird | 1:140.6.0esr-1~deb13u1 |
| debian 14 | firefox-esr | 140.6.0esr-1 |
| debian 14 | thunderbird | 1:140.6.0esr-1 |
| echo | firefox-esr | 140.6.0esr-1~deb12u1 |
| echo | thunderbird | 1:140.6.0esr-1~deb12u1 |
| Oracle Linux 7 | firefox | 140.6.0-1.0.1.el7_9 |
| Oracle Linux 8 | firefox | 140.6.0-1.0.1.el8_10 |
| Oracle Linux 8 | thunderbird | 140.6.0-1.0.1.el8_10 |
| Oracle Linux 9 | firefox | 140.6.0-1.0.1.el9_7 |
| Oracle Linux 9 | firefox-x11 | 140.6.0-1.0.1.el9_7 |
| Oracle Linux 9 | thunderbird | 140.6.0-1.0.1.el9_7 |
| rapidfort alpine 3.20 | firefox | 142.0-r0 |
| rapidfort alpine 3.20 | firefox-esr | sin corrección indicada |
| rapidfort alpine 3.20 | thunderbird | 144.0-r0 |
| rapidfort alpine 3.21 | firefox | 142.0-r0 |
| rapidfort alpine 3.21 | firefox-esr | sin corrección indicada |
| rapidfort alpine 3.21 | thunderbird | 144.0-r0 |
| rapidfort alpine 3.22 | firefox-esr | sin corrección indicada |
| rapidfort alpine 3.22 | thunderbird | 144.0-r0 |
| rapidfort alpine 3.23 | firefox-esr | sin corrección indicada |
| rapidfort alpine 3.23 | thunderbird | 144.0-r0 |
| rapidfort alpine 3.24 | firefox-esr | sin corrección indicada |
| rapidfort amazon linux 2023 | firefox | 140.6.0-1.amzn2023.0.1 |
| rapidfort debian 12 | firefox-esr | 0:140.6.0esr-1, 0:140.6.0esr-1~deb11u1, 0:140.6.0esr-1~deb12u1, 0:140.6.0esr-1~deb13u1 |
| rapidfort debian 12 | thunderbird | 0:140.6.0esr-1~deb11u1, 0:140.6.0esr-1~deb13u1, 1:140.6.0esr-1, 1:140.6.0esr-1~deb12u1 |
| rapidfort debian 13 | firefox-esr | 0:140.6.0esr-1, 0:140.6.0esr-1~deb11u1, 0:140.6.0esr-1~deb12u1, 0:140.6.0esr-1~deb13u1 |
| rapidfort debian 13 | thunderbird | 0:140.6.0esr-1~deb11u1, 0:140.6.0esr-1~deb13u1, 1:140.6.0esr-1, 1:140.6.0esr-1~deb12u1 |
| rapidfort fedora 43 | thunderbird | 145.0-1.fc43 |
| rapidfort fedora 43 | thunderbird-librnp-rnp | 145.0-1.fc43 |
| rapidfort Oracle Linux 10 | firefox | 0:140.6.0-1.0.1.el10_1 |
| rapidfort Oracle Linux 10 | thunderbird | 0:140.6.0-1.0.1.el10_1 |
| rapidfort Oracle Linux 9 | firefox | 0:140.6.0-1.0.1.el9_7 |
| rapidfort Oracle Linux 9 | firefox-x11 | 0:140.6.0-1.0.1.el9_7 |
| rapidfort Oracle Linux 9 | thunderbird | 0:140.6.0-1.0.1.el9_7 |
| Red Hat | firefox | sin corrección indicada |
| Red Hat | thunderbird | sin corrección indicada |
| rocky 10 | firefox | 140.6.0-1.el10_1 |
| rocky 10 | thunderbird | 140.6.0-1.el10_1 |
| rocky 8 | firefox | 140.6.0-1.el8_10 |
| rocky 8 | thunderbird | 140.6.0-1.el8_10 |
| rocky 9 | firefox | 140.6.0-1.el9_7 |
| rocky 9 | firefox-x11 | 140.6.0-1.el9_7 |
| rocky 9 | thunderbird | 140.6.0-1.el9_7 |
| ubuntu 22.04 | thunderbird | 1:140.7.1+build1-0ubuntu0.22.04.1 |
| wolfi | firefox | 140.6-r0 |
Referencias
- https://access.redhat.com/errata/RHSA-2025:23856
- https://access.redhat.com/security/cve/CVE-2025-14330
- https://bugzilla.mozilla.org/show_bug.cgi?id=1997503
- https://bugzilla.redhat.com/2420502
- https://bugzilla.redhat.com/2420503
- https://bugzilla.redhat.com/2420504
- https://bugzilla.redhat.com/2420506
- https://bugzilla.redhat.com/2420508
Las 48 referencias
- https://bugzilla.redhat.com/2420509
- https://bugzilla.redhat.com/2420512
- https://bugzilla.redhat.com/2420513
- https://bugzilla.redhat.com/2420516
- https://bugzilla.redhat.com/2420517
- https://bugzilla.redhat.com/show_bug.cgi?id=2420502
- https://bugzilla.redhat.com/show_bug.cgi?id=2420503
- https://bugzilla.redhat.com/show_bug.cgi?id=2420504
- https://bugzilla.redhat.com/show_bug.cgi?id=2420506
- https://bugzilla.redhat.com/show_bug.cgi?id=2420508
- https://bugzilla.redhat.com/show_bug.cgi?id=2420509
- https://bugzilla.redhat.com/show_bug.cgi?id=2420512
- https://bugzilla.redhat.com/show_bug.cgi?id=2420513
- https://bugzilla.redhat.com/show_bug.cgi?id=2420516
- https://bugzilla.redhat.com/show_bug.cgi?id=2420517
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14321
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14322
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14323
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14324
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14325
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14328
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14329
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14330
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14331
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14333
- https://errata.almalinux.org/9/ALSA-2025-23856.html
- https://errata.rockylinux.org/RLSA-2025:23856
- https://linux.oracle.com/cve/CVE-2025-14330.html
- https://linux.oracle.com/errata/ELSA-2026-0026.html
- https://nvd.nist.gov/vuln/detail/CVE-2025-14330
- https://ubuntu.com/security/notices/USN-7991-1
- https://www.cve.org/CVERecord?id=CVE-2025-14330
- https://www.mozilla.org/en-US/security/advisories/mfsa2025-92/#CVE-2025-14330
- https://www.mozilla.org/en-US/security/advisories/mfsa2025-94/#CVE-2025-14330
- https://www.mozilla.org/security/advisories/mfsa2025-92/
- https://www.mozilla.org/security/advisories/mfsa2025-94/
- https://www.mozilla.org/security/advisories/mfsa2025-94/#CVE-2025-14330
- https://www.mozilla.org/security/advisories/mfsa2025-95/
- https://www.mozilla.org/security/advisories/mfsa2025-96/