Critical Security Update for Firefox: Addressing Multiple Vulnerabilities
Summary
ALSA-2025:16108: Important: firefox security update. Affects firefox versions < 140.3.0-1.el9_6.alma.1. Fixed in 140.3.0-1.el9_6.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Firefox is a widely-used open-source web browser known for its commitment to standards compliance, performance, and portability. It offers a range of features including tabbed browsing, privacy controls, and a customizable interface. However, like any software, it is susceptible to vulnerabilities that can compromise user security and privacy. The recent vulnerabilities identified in Firefox highlight critical issues that could allow attackers to exploit the browser's functionalities.
Vulnerability Detail
The vulnerabilities in Firefox stem from various components, including the Graphics: Canvas2D and JavaScript: GC. These issues include a sandbox escape due to a use-after-free error, incorrect boundary conditions, and an integer overflow in the SVG component. Such vulnerabilities can lead to unauthorized access, data leakage, and potential system compromise, making it imperative for users to update their browsers promptly.
How To Fix
Minimum fixed version
140.3.0-1.el9_6.alma.1
This is the first release that contains the fix.
sudo dnf update firefoxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable JavaScript or avoid using the affected components until the update is applied. However, this may limit browser functionality and is not a permanent solution.
Conclusion
The recent vulnerabilities in Firefox underscore the importance of maintaining up-to-date software to protect against potential security threats. Users are strongly encouraged to update to the latest patched version to mitigate risks associated with these vulnerabilities.
See every vulnerability recorded for firefox →
FAQ
The vulnerabilities include sandbox escapes, memory safety bugs, and information disclosure issues, all of which can compromise user security.
You can check your version of Firefox by navigating to 'Help' > 'About Firefox'. Compare it with the patched version 140.3.0-1.el9_6.alma.1.
As a temporary workaround, consider disabling JavaScript or avoiding the use of affected features until you can apply the update.
Detailed information can be found on the CVE pages associated with the vulnerabilities, as well as the advisory from AlmaLinux.
Vulert allows users to monitor and alert for open-source vulnerabilities in their software using a manifest file like package-lock.json, without requiring code access or installation.
Related vulnerabilities
Recent vulnerabilities recorded for firefox.
