BSD Ports

mozilla -- multiple vulnerabilities

· CVE-2025-1932, CVE-2025-1941, CVE-2025-1942, CVE-2025-27424 · VuXML entry

[email protected] reports: An inconsistent comparator in xslt/txNodeSorter could have resulted in potentially exploitable out-of-bounds access. Only affected version 122 and later. This vulnerability affects Firefox < 136, Firefox ESR < 128.8, Thunderbird < 136, and Thunderbird < 128.8. Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be …

Affected versions

By system

2 still vulnerable, 5 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.

SystemPortVersionStateFixed
DragonFlywww/firefox131.0_1,2 vulnerable since 2025-03-30
OpenBSDwww/mozilla-firefox158.0.1 out of range, by version
NetBSDwww/firefox154.0.1nb1 not listed
MidnightBSDwww/firefox158.0.1,2 out of range, by version
FreeBSDwww/firefox158.0.1,2 fixed (500 days after)
DragonFlywww/firefox-esr128.12.0,1 fixed
OpenBSDwww/firefox-esr153.5.1 out of range, by version
NetBSDwww/firefox-esr140 not listed
MidnightBSDwww/firefox-esr153.5.1,1 out of range, by version
FreeBSDwww/firefox-esr153.5.1,2 fixed (472 days after)
DragonFlymail/thunderbird128.3.0_2 vulnerable since 2025-03-30
OpenBSDmail/mozilla-thunderbird153.5.1 out of range, by version
NetBSDmail/thunderbird154.0nb1 not listed
MidnightBSDmail/thunderbird158.0.1 out of range, by version
FreeBSDmail/thunderbird158.0.1 fixed (499 days after)
FreeBSDwww/librewolf158.0.1 fixed (489 days after)
OpenBSDwww/librewolf158.0pl1 out of range, by version