Critical Security Update for Firefox: Addressing URL Spoofing and Memory Safety Issues
Summary
ALSA-2025:3582: Important: firefox security update. Affects firefox versions < 128.9.0-2.el8_10. Fixed in 128.9.0-2.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Firefox is a widely used open-source web browser known for its commitment to standards compliance, performance, and portability. It is designed to provide users with a secure and efficient browsing experience. However, like any software, it can be vulnerable to security threats. The recent vulnerabilities identified in Firefox highlight the importance of regular updates to maintain security integrity.
Vulnerability Detail
The vulnerabilities identified in this update include URL Bar Spoofing via non-BMP Unicode characters (CVE-2025-3029), a Use-after-free issue triggered by XSLTProcessor (CVE-2025-3028), and several memory safety bugs (CVE-2025-3030). These vulnerabilities can lead to various security risks, including unauthorized access to sensitive information, potential data breaches, and exploitation by malicious actors. The memory safety bugs, in particular, can compromise the stability and security of the browser, making it crucial for users to apply the updates promptly.
How To Fix
Minimum fixed version
128.9.0-2.el8_10
This is the first release that contains the fix.
sudo dnf update firefoxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for these vulnerabilities. The best course of action is to apply the security update as soon as it is available.
Conclusion
In summary, the recent security update for Firefox addresses critical vulnerabilities that could compromise user security. It is essential for users to update their browsers to the latest version to mitigate these risks. Regular monitoring of vulnerabilities using tools like Vulert can further enhance security practices.
See every vulnerability recorded for firefox →
FAQ
The update addresses URL Bar Spoofing, a Use-after-free issue, and several memory safety bugs.
You can check your Firefox version by navigating to 'Help' > 'About Firefox'. If your version is below 128.9.0-2.el8_10, it is affected.
While there are no specific workarounds, it is recommended to avoid sensitive activities until the update can be applied.
More information can be found on the CVE pages for CVE-2025-3028, CVE-2025-3029, and CVE-2025-3030.
Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in your software, providing an easy way to stay informed.
Related vulnerabilities
Recent vulnerabilities recorded for firefox.
