# ALSA-2025:11748: Security update for 2 packages

ALSA-2025:11748, released July 24, 2025, fixes 9 CVEs across 2 products. None of them is reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/fix/linux/alsa-2025-11748
- Platform: Linux
- Released: Jul 24, 2025
- Priority: High (Closes CVE-2025-8028, high severity)
- CVEs: 9, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://osv.dev/vulnerability/ALSA-2025:11748

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [firefox](https://patchblox.com/security/data/product/linux/firefox.md) | almalinux 9 | 128.13.0-1.el9_6.alma.1 |
| [firefox-x11](https://patchblox.com/security/data/product/linux/firefox-x11.md) | almalinux 9 | 128.13.0-1.el9_6.alma.1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2025-8028](https://patchblox.com/security/data/cve/CVE-2025-8028.md) | High | Large branch table could lead to truncated instruction | 9.8 | 0.0058 |  |
| [CVE-2025-8031](https://patchblox.com/security/data/cve/CVE-2025-8031.md) | High | Incorrect URL stripping in CSP reports | 9.8 | 0.0051 |  |
| [CVE-2025-8034](https://patchblox.com/security/data/cve/CVE-2025-8034.md) | High | Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141 | 8.8 | 0.0046 |  |
| [CVE-2025-8027](https://patchblox.com/security/data/cve/CVE-2025-8027.md) | High | JavaScript engine only wrote partial return value to stack | 7.5 | 0.0043 |  |
| [CVE-2025-8033](https://patchblox.com/security/data/cve/CVE-2025-8033.md) | High | Incorrect JavaScript state machine for generators | 7.5 | 0.0043 |  |
| [CVE-2025-8035](https://patchblox.com/security/data/cve/CVE-2025-8035.md) | High | Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141 | 8.8 | 0.0040 |  |
| [CVE-2025-8029](https://patchblox.com/security/data/cve/CVE-2025-8029.md) | High | javascript: URLs executed on object and embed tags | 8.1 | 0.0038 |  |
| [CVE-2025-8030](https://patchblox.com/security/data/cve/CVE-2025-8030.md) | High | Potential user-assisted code execution in “Copy as cURL” command | 8.1 | 0.0038 |  |
| [CVE-2025-8032](https://patchblox.com/security/data/cve/CVE-2025-8032.md) | High | XSLT documents could bypass CSP | 8.1 | 0.0038 |  |

---

Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo