Critical Security Flaw in Firefox: Important Update Required
Summary
ALSA-2025:10072: Important: firefox security update. Affects firefox versions < 128.12.0-1.el9_6.alma.1. Fixed in 128.12.0-1.el9_6.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Firefox is a widely-used open-source web browser known for its commitment to standards compliance, performance, and portability. It is designed to provide users with a secure and efficient browsing experience. However, like any software, it is susceptible to vulnerabilities that can compromise user security and privacy. The recent security update addresses several critical issues that could potentially expose users to various risks.
Vulnerability Detail
The vulnerability in question arises from multiple security flaws in Firefox, including a use-after-free error in FontFaceSet, incorrect parsing of URLs that could allow unauthorized embedding of content, and exposure of a persistent UUID through the WebCompat WebExtension. These vulnerabilities could lead to unauthorized access, data leakage, or even exploitation by malicious actors. Specifically, CVE-2025-6430 allows the Content-Disposition header to be ignored when files are included in embed or object tags, which could facilitate unintended file downloads.
How To Fix
Minimum fixed version
128.12.0-1.el9_6.alma.1
This is the first release that contains the fix.
sudo dnf update firefoxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for these vulnerabilities. The best course of action is to apply the security update as soon as it becomes available.
Conclusion
In summary, the recent security update for Mozilla Firefox addresses critical vulnerabilities that could compromise user security. It is essential for users to update to the latest version to protect against potential exploits. Utilizing tools like Vulert can further enhance security by monitoring for vulnerabilities in real-time.
See every vulnerability recorded for firefox →
FAQ
The update addresses several vulnerabilities, including a use-after-free error, incorrect URL parsing, and exposure of a persistent UUID.
You can check your version of Firefox by navigating to 'Help' > 'About Firefox'. Compare it with the patched version 128.12.0-1.el9_6.alma.1.
While there are no specific workarounds, it is crucial to minimize your browsing activities and avoid accessing sensitive information until the update is applied.
Detailed information about the vulnerabilities can be found on the CVE pages for CVE-2025-6424, CVE-2025-6425, CVE-2025-6429, and CVE-2025-6430.
Vulert monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json, allowing for real-time updates without requiring code access.
Related vulnerabilities
Recent vulnerabilities recorded for firefox.
