BSD Ports

mozilla -- multiple vulnerabilities

· CVE-2025-1009, CVE-2025-1010, CVE-2025-1012, CVE-2025-1016 · VuXML entry

[email protected] reports: An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash. An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash. A race during concurrent delazification could have led to a use-after-free. Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR …

Affected versions

By system

2 still vulnerable, 4 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.

SystemPortVersionStateFixed
DragonFlywww/firefox131.0_1,2 vulnerable since 2025-02-07
OpenBSDwww/mozilla-firefox158.0.1 out of range, by version
NetBSDwww/firefox154.0.1nb1 not listed
MidnightBSDwww/firefox158.0.1,2 out of range, by version
FreeBSDwww/firefox158.0.1,2 fixed (551 days after)
DragonFlywww/firefox-esr128.12.0,1 fixed
OpenBSDwww/firefox-esr153.5.1 out of range, by version
NetBSDwww/firefox-esr140 not listed
MidnightBSDwww/firefox-esr153.5.1,1 out of range, by version
FreeBSDwww/firefox-esr153.5.1,2 fixed (523 days after)
DragonFlymail/thunderbird128.3.0_2 vulnerable since 2025-02-07
OpenBSDmail/mozilla-thunderbird153.5.1 out of range, by version
NetBSDmail/thunderbird154.0nb1 not listed
MidnightBSDmail/thunderbird158.0.1 out of range, by version
FreeBSDmail/thunderbird158.0.1 fixed (550 days after)