This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Mozilla Firefox and Thunderbird fix 11 vulnerabilities

Mozilla fixes 11 vulnerabilities in Thunderbird, Thunderbird ESR, Firefox and Firefox ESR [1][2][3][4][5]. The most severe vulnerabilities are listed below. Individual products and their fixed versions: Firefox - 134 [1] Firefox ESR - 128.6, 115.19 [2][3] Thunderbird - 134 [4] Thunderbird ESR - 128.6 [5]

Mozilla Firefox & Thunderbird - data spoofing (CVE-2025-0244)
CVSS 5.3 (Medium)

Allows an unauthenticated remote attacker, when redirecting the victim, to influence the displayed URL under certain circumstances. The vulnerability affects only the Android operating system [1].

The vulnerability is present in product:

  • Firefox; < 134;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

More information:

The vulnerability was publicly disclosed 7. 1. 2025.

Mozilla Firefox & Thunderbird - RCE (CVE-2025-0242)
CVSS 8.1 (High)

Allows an unauthenticated remote attacker to corrupt data in memory and potentially execute code [1][2][3][4][5].

The vulnerability is present in products:

  • Firefox; < 134;
  • Firefox ESR; >=128, < 128.6; < 115.19;
  • Thunderbird; < 134;
  • Thunderbird ESR; < 128.6;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 7. 1. 2025.

Mozilla Firefox & Thunderbird - RCE (CVE-2025-0247)
CVSS 8.1 (High)

Allows an unauthenticated remote attacker to corrupt data in memory and potentially execute code [1][4].

The vulnerability is present in products:

  • Firefox; < 134;
  • Thunderbird; < 134;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 7. 1. 2025.

By CESNET, z.s.p.o. Martin Krajči on 10. 1. 2025.

CESNET, z.s.p.o. Logo