Critical Security Update for Firefox: Addressing Multiple Memory Safety Vulnerabilities
Summary
ALSA-2025:18155: Important: firefox security update. Affects firefox versions < 140.4.0-3.el9_6.alma.1. Fixed in 140.4.0-3.el9_6.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Firefox is a widely-used open-source web browser known for its commitment to standards compliance, performance, and portability. It serves millions of users globally, providing a secure browsing experience. However, recent vulnerabilities have been identified that could compromise user data and browser integrity, necessitating immediate attention.
Vulnerability Detail
The vulnerabilities in question include memory safety bugs and out-of-bounds read/write issues triggered by WebGL textures. These vulnerabilities can lead to potential data leaks, crashes, and unauthorized access to sensitive information. Specifically, CVE-2025-11708 indicates a use-after-free error, while CVE-2025-11710 highlights cross-process information leakage due to malicious IPC messages. The implications of these vulnerabilities are severe, as they can be exploited by attackers to execute arbitrary code or manipulate browser behavior.
How To Fix
Minimum fixed version
140.4.0-3.el9_6.alma.1
This is the first release that contains the fix.
sudo dnf update firefoxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable WebGL in Firefox settings to mitigate the risk of exploitation until the update is applied. This can be done by navigating to 'about:config' in the Firefox address bar, searching for 'webgl.disabled', and setting it to 'true'.
Conclusion
The identified vulnerabilities in Mozilla Firefox pose significant risks to users, necessitating immediate updates to the latest patched versions. By following the outlined steps to update and applying temporary workarounds, users can protect themselves from potential exploits.
See every vulnerability recorded for firefox →
FAQ
The update addresses multiple vulnerabilities, including memory safety bugs and out-of-bounds read/write issues, which could lead to data leaks and crashes.
You can check your Firefox version by going to 'Help' > 'About Firefox'. Compare it with the patched version 140.4.0-3.el9_6.alma.1.
As a temporary workaround, you can disable WebGL in the browser settings to reduce the risk of exploitation.
Detailed information about the vulnerabilities can be found on the CVE pages listed in the advisory, including their impacts and technical details.
Vulert monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json, providing real-time insights without requiring code access.
Related vulnerabilities
Recent vulnerabilities recorded for firefox.
