Critical Security Update for Firefox ESR: DSA-5858-1
Summary
DSA-5858-1: firefox-esr - security update. Affects firefox-esr versions < 128.7.0esr-1~deb12u1. Fixed in 128.7.0esr-1~deb12u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Firefox ESR (Extended Support Release) is a version of the Firefox web browser designed for organizations that need extended support for mass deployments. It provides a stable platform for users who require a reliable browser without frequent updates. However, like any software, it is susceptible to vulnerabilities that can compromise user security and privacy.
Vulnerability Detail
The vulnerability identified in this update, referenced as DSA-5858-1, affects the Firefox ESR package due to multiple security flaws. These flaws can lead to various issues, including potential data breaches, unauthorized access to sensitive information, and exploitation by malicious actors. The vulnerabilities are cataloged under several CVEs, including CVE-2024-11704 and CVE-2025-1017, which detail specific attack vectors and their implications.
How To Fix
Minimum fixed version
128.7.0esr-1~deb12u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade firefox-esrTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit their exposure by avoiding untrusted websites and disabling any unnecessary browser extensions until the update is applied. Additionally, users can consider using alternative browsers that are not affected by this vulnerability.
Conclusion
In summary, the DSA-5858-1 security update for Firefox ESR addresses critical vulnerabilities that could compromise user security. It is essential for users to update their software promptly to mitigate risks. Utilizing tools like Vulert can further enhance security by monitoring for vulnerabilities in real-time.
See every vulnerability recorded for firefox-esr →
FAQ
The vulnerabilities can lead to data breaches, unauthorized access, and exploitation by attackers, potentially compromising user security.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update immediately, avoid visiting untrusted websites and disable unnecessary extensions to minimize risk.
Yes, the vulnerabilities are documented under several CVEs, indicating that they are known and could potentially be exploited by attackers.
Vulert monitors and alerts in real-time for open-source vulnerabilities using a manifest file like package-lock.json, helping you maintain secure software.
Related vulnerabilities
Recent vulnerabilities recorded for firefox-esr.
