Critical Security Update for Firefox: Addressing Multiple Vulnerabilities
Summary
RLSA-2025:14442: Important: firefox security update. Affects firefox versions < 0:128.14.0-2.el8_10. Fixed in 0:128.14.0-2.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Firefox is a widely-used open-source web browser known for its commitment to standards compliance, performance, and portability. It supports a variety of web technologies and is favored for its user privacy features. However, recent vulnerabilities have been identified that could compromise its security, necessitating immediate attention from users and administrators.
Vulnerability Detail
The vulnerabilities in Firefox include a denial-of-service issue due to out-of-memory conditions in the WebRender component (CVE-2025-9182), a sandbox escape caused by an invalid pointer in the Audio/Video GMP component (CVE-2025-9179), a same-origin policy bypass in the Canvas2D component (CVE-2025-9180), and uninitialized memory in the JavaScript Engine (CVE-2025-9181). Additionally, memory safety bugs have been addressed in various versions of Firefox and Thunderbird (CVE-2025-9185). These vulnerabilities could lead to severe security breaches, including unauthorized access and data leakage.
How To Fix
Minimum fixed version
0:128.14.0-2.el8_10
This is the first release that contains the fix.
sudo dnf update firefoxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to limit the use of Firefox for sensitive activities until the update is applied. Additionally, disabling certain features like WebRender may reduce the risk of exploitation until the patch is installed.
Conclusion
The identified vulnerabilities in Firefox pose significant risks to users and require immediate action. By updating to the latest patched version, users can protect themselves from potential exploits. It is also advisable to monitor for vulnerabilities using tools like Vulert to ensure ongoing security.
See every vulnerability recorded for firefox →
FAQ
The main vulnerabilities include denial-of-service issues, sandbox escapes, same-origin policy bypasses, and uninitialized memory issues.
You can check your Firefox version by navigating to 'Help' > 'About Firefox'. Compare it with the patched version 0:128.14.0-2.el8_10.
If you cannot update immediately, limit your use of Firefox for sensitive tasks and consider disabling features that may expose you to risk.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
The CVSS score for these vulnerabilities is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for firefox.
