BSD Ports

mozilla -- multiple vulnerabilities

· CVE-2025-1011, CVE-2025-1013, CVE-2025-1014, CVE-2025-1017 · VuXML entry

[email protected] reports: A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code execution. A race condition could have led to private browsing tabs being opened in normal browsing windows. This could have resulted in a potential privacy leak. Certificate length was not properly checked when added to a certificate store. In …

Affected versions

By system

2 still vulnerable, 4 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.

SystemPortVersionStateFixed
DragonFlywww/firefox131.0_1,2 vulnerable since 2025-02-07
OpenBSDwww/mozilla-firefox158.0.1 out of range, by version
NetBSDwww/firefox154.0.1nb1 not listed
MidnightBSDwww/firefox158.0.1,2 out of range, by version
FreeBSDwww/firefox158.0.1,2 fixed (551 days after)
DragonFlywww/firefox-esr128.12.0,1 fixed
OpenBSDwww/firefox-esr153.5.1 out of range, by version
NetBSDwww/firefox-esr140 not listed
MidnightBSDwww/firefox-esr153.5.1,1 out of range, by version
FreeBSDwww/firefox-esr153.5.1,2 fixed (523 days after)
DragonFlymail/thunderbird128.3.0_2 vulnerable since 2025-02-07
OpenBSDmail/mozilla-thunderbird153.5.1 out of range, by version
NetBSDmail/thunderbird154.0nb1 not listed
MidnightBSDmail/thunderbird158.0.1 out of range, by version
FreeBSDmail/thunderbird158.0.1 fixed (550 days after)