BSD Ports

mozilla -- memory corruption

· CVE-2025-1938, CVE-2025-1935, CVE-2025-1934 · VuXML entry

[email protected] reports: CVE-2025-1938: Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. CVE-2025-1935: A web page could trick a user into setting that site as the default handler for a custom URL …

Affected versions

By system

2 still vulnerable, 5 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.

SystemPortVersionStateFixed
DragonFlywww/firefox131.0_1,2 vulnerable since 2025-04-03
OpenBSDwww/mozilla-firefox158.0.1 out of range, by version
NetBSDwww/firefox154.0.1nb1 not listed
MidnightBSDwww/firefox158.0.1,2 out of range, by version
FreeBSDwww/firefox158.0.1,2 fixed (496 days after)
FreeBSDwww/librewolf158.0.1 fixed (485 days after)
OpenBSDwww/librewolf158.0pl1 out of range, by version
DragonFlywww/firefox-esr128.12.0,1 fixed
OpenBSDwww/firefox-esr153.5.1 out of range, by version
NetBSDwww/firefox-esr140 not listed
MidnightBSDwww/firefox-esr153.5.1,1 out of range, by version
FreeBSDwww/firefox-esr153.5.1,2 fixed (468 days after)
DragonFlymail/thunderbird128.3.0_2 vulnerable since 2025-04-03
OpenBSDmail/mozilla-thunderbird153.5.1 out of range, by version
NetBSDmail/thunderbird154.0nb1 not listed
MidnightBSDmail/thunderbird158.0.1 out of range, by version
FreeBSDmail/thunderbird158.0.1 fixed (495 days after)