Critical Security Update for Firefox: Out-of-Bounds Access Vulnerabilities
Summary
ALSA-2025:8060: Important: firefox security update. Affects firefox versions < 128.10.1-1.el8_10.alma.1. Fixed in 128.10.1-1.el8_10.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Firefox is a widely-used open-source web browser known for its commitment to standards compliance, performance, and portability. It supports various web technologies and is favored for its privacy features and extensive add-ons. However, like any software, it can be susceptible to vulnerabilities that may compromise user security and data integrity.
Vulnerability Detail
The vulnerabilities identified in this update are two out-of-bounds access issues. The first, CVE-2025-4918, occurs when resolving Promise objects, potentially allowing an attacker to exploit memory corruption. The second, CVE-2025-4919, involves out-of-bounds access during the optimization of linear sums, which could also lead to memory corruption. Both vulnerabilities can result in crashes or arbitrary code execution, posing significant risks to users.
How To Fix
Minimum fixed version
128.10.1-1.el8_10.alma.1
This is the first release that contains the fix.
sudo dnf update firefoxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for these vulnerabilities. The best course of action is to apply the security update as soon as it becomes available.
Conclusion
The recent security update for Firefox addresses critical out-of-bounds access vulnerabilities that could lead to severe security risks. Users are strongly encouraged to update their browsers to the latest version to protect their data and privacy.
See every vulnerability recorded for firefox →
FAQ
The update addresses two out-of-bounds access vulnerabilities: CVE-2025-4918 and CVE-2025-4919, which could lead to memory corruption.
You can verify your Firefox version by navigating to 'Help' > 'About Firefox'. If your version is below 128.10.1-1.el8_10.alma.1, it is affected.
While there are no specific workarounds, it is crucial to minimize exposure by avoiding untrusted websites and disabling any unnecessary add-ons until the update can be applied.
Detailed information about the vulnerabilities can be found on the CVE pages for CVE-2025-4918 and CVE-2025-4919.
Vulert monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json, providing real-time insights without requiring code access.
Related vulnerabilities
Recent vulnerabilities recorded for firefox.
