This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Mozilla Firefox fixes 2 vulnerabilities
Mozilla fixes two high-severity vulnerabilities in Firefox and Firefox ESR [1]. Fixed versions of the individual products: Firefox - 138.0.4 [2] Firefox ESR - 128.10.1 [3], 115.23.1 [4]
An unauthenticated remote attacker can read/write outside the bounds of allocated memory due to improper handling of array index sizes in JavaScript, which may lead to leakage of sensitive data or, in combination with another vulnerability, to code execution [5][6].
The vulnerability is present in products:
- *:Firefox; <138.0.4;
- *:Firefox ESR; <115.23.1; >=128.0, <128.10.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2025-4919 at cve.org, NVD
- CWE-125: Out-of-bounds Read at cwe.mitre.org
- CWE-787: Out-of-bounds Write at cwe.mitre.org
The vulnerability was publicly disclosed 17. 5. 2025.
An unauthenticated remote attacker can read/write outside the bounds of allocated memory due to improper handling of the 'Promise' object in JavaScript, which may lead to leakage of sensitive data or, in combination with another vulnerability, to code execution [7][6].
The vulnerability is present in products:
- *:Firefox; <138.0.4;
- *:Firefox ESR; <115.23.1; >=128.0, <128.10.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2025-4918 at cve.org, NVD
- CWE-125: Out-of-bounds Read at cwe.mitre.org
- CWE-787: Out-of-bounds Write at cwe.mitre.org
The vulnerability was publicly disclosed 17. 5. 2025.
Links
- [1] https://www.mozilla.org/en-US/security/advisories/
- [2] https://www.mozilla.org/en-US/security/advisories/mfsa2025-36/
- [3] https://www.mozilla.org/en-US/security/advisories/mfsa2025-37/
- [4] https://www.mozilla.org/en-US/security/advisories/mfsa2025-38/
- [5] https://access.redhat.com/security/cve/cve-2025-4919
- [6] https://blog.mozilla.org/security/2025/05/17/firefox-security-response-to-pwn2own-2025/
- [7] https://access.redhat.com/security/cve/cve-2025-4918
By CESNET, z.s.p.o. Michaela Ručková on 21. 5. 2025.