Critical Security Update for Firefox ESR: DSA-5874-1
Summary
DSA-5874-1: firefox-esr - security update. Affects firefox-esr versions < 128.8.0esr-1~deb12u1. Fixed in 128.8.0esr-1~deb12u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Firefox ESR (Extended Support Release) is a version of the Firefox web browser designed for organizations that need extended support for mass deployments. It provides a stable platform with security updates while minimizing disruptions from frequent feature changes. This vulnerability affects the Debian 12 package of Firefox ESR, which is widely used in enterprise environments.
Vulnerability Detail
The vulnerability identified in this update is associated with multiple CVEs, including CVE-2024-43097 and CVE-2025-1931 through CVE-2025-1938. These vulnerabilities could allow attackers to execute arbitrary code, compromise user data, or lead to denial-of-service conditions. The vulnerabilities stem from flaws in the browser's handling of certain web content, which can be exploited through malicious websites or crafted content.
How To Fix
Minimum fixed version
128.8.0esr-1~deb12u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade firefox-esrTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users are advised to avoid visiting untrusted websites or opening suspicious links until the package is updated. Additionally, consider using alternative browsers that are not affected by this vulnerability.
Conclusion
In summary, the security update for Firefox ESR (DSA-5874-1) addresses critical vulnerabilities that could have severe implications for users. It is essential to update to the latest version to protect against potential exploits.
See every vulnerability recorded for firefox-esr →
FAQ
The impact can range from data compromise to complete system takeover, depending on the exploit used.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, if exploited, this vulnerability could lead to unauthorized access to sensitive data.
If immediate updates are not possible, avoid using the affected software and monitor for any suspicious activity.
Detailed information can be found in the Debian security advisory DSA-5874-1 and related CVE entries.
Related vulnerabilities
Recent vulnerabilities recorded for firefox-esr.
