Security update for MozillaFirefox

Announcement ID: SUSE-SU-2025:0056-1
Release Date: 2025-01-09T16:59:18Z
Rating: important
References:
Cross-References:
CVSS scores:
  • CVE-2025-0237 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
  • CVE-2025-0237 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
  • CVE-2025-0238 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
  • CVE-2025-0238 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
  • CVE-2025-0239 ( SUSE ): 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
  • CVE-2025-0239 ( NVD ): 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
  • CVE-2025-0240 ( SUSE ): 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
  • CVE-2025-0240 ( NVD ): 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
  • CVE-2025-0242 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
  • CVE-2025-0242 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
  • CVE-2025-0243 ( SUSE ): 5.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
  • CVE-2025-0243 ( NVD ): 5.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected Products:
  • SUSE Linux Enterprise High Performance Computing 12 SP5
  • SUSE Linux Enterprise Server 12 SP5
  • SUSE Linux Enterprise Server 12 SP5 LTSS
  • SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security
  • SUSE Linux Enterprise Server for SAP Applications 12 SP5

An update that solves seven vulnerabilities can now be installed.

Description:

This update for MozillaFirefox fixes the following issues:

  • Firefox Extended Support Release 128.6.0 ESR
  • Fixed: Various security fixes.

MFSA 2025-02 (bsc#1234991) * CVE-2025-0237 (bmo#1915257) WebChannel APIs susceptible to confused deputy attack * CVE-2025-0238 (bmo#1915535) Use-after-free when breaking lines * CVE-2025-0239 (bmo#1929156) Alt-Svc ALPN validation failure when redirected * CVE-2025-0240 (bmo#1929623) Compartment mismatch when parsing JavaScript JSON module * CVE-2025-0241 (bmo#1933023) Memory corruption when using JavaScript Text Segmentation * CVE-2025-0242 (bmo#1874523, bmo#1926454, bmo#1931873, bmo#1932169) Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6 * CVE-2025-0243 (bmo#1827142, bmo#1932783) Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6

  • Firefox Extended Support Release 128.5.2 ESR
  • Fixed: Fixed a crash experienced by Windows users with Qihoo 360 Total Security Antivirus software installed (bmo#1934258)

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE Linux Enterprise Server 12 SP5 LTSS
    zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-2025-56=1
  • SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security
    zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2025-56=1

Package List:

  • SUSE Linux Enterprise Server 12 SP5 LTSS (aarch64 ppc64le s390x x86_64)
    • MozillaFirefox-128.6.0-112.243.1
    • MozillaFirefox-debuginfo-128.6.0-112.243.1
    • MozillaFirefox-translations-common-128.6.0-112.243.1
    • MozillaFirefox-debugsource-128.6.0-112.243.1
  • SUSE Linux Enterprise Server 12 SP5 LTSS (noarch)
    • MozillaFirefox-devel-128.6.0-112.243.1
  • SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (x86_64)
    • MozillaFirefox-128.6.0-112.243.1
    • MozillaFirefox-debuginfo-128.6.0-112.243.1
    • MozillaFirefox-translations-common-128.6.0-112.243.1
    • MozillaFirefox-debugsource-128.6.0-112.243.1
  • SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (noarch)
    • MozillaFirefox-devel-128.6.0-112.243.1

References: