Linux · Security advisory · February 5, 2025
ELSA-2025-1066: Security update for 2 packages
ELSA-2025-1066, released February 5, 2025, fixes 8 CVEs across 2 products. None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
8
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0121
68th percentile
Priority of the 8 CVEs
Patch now 0
Urgent 0
High 8
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| firefox | ol 9 | 0:128.7.0-1.0.1.el9_5 |
| firefox-x11 | ol 9 | 0:128.7.0-1.0.1.el9_5 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2025-1009 | Use-after-free in XSLT | 9.8 | 0.0121 | None reported | |
| High | CVE-2025-1011 | A bug in WebAssembly code generation could result in a crash | 8.8 | 0.0063 | None reported | |
| High | CVE-2025-1016 | Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20, and Thunderbird 128.7 | 9.8 | 0.0059 | None reported | |
| High | CVE-2025-1017 | Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7 | 9.8 | 0.0058 | None reported | |
| High | CVE-2025-1010 | Use-after-free in Custom Highlight | 8.8 | 0.0046 | None reported | |
| High | CVE-2025-1012 | Use-after-free during concurrent delazification | 8.8 | 0.0045 | None reported | |
| High | CVE-2025-1014 | Certificate length was not properly checked | 8.8 | 0.0039 | None reported | |
| High | CVE-2025-1013 | Potential opening of private browsing tabs in normal browsing windows | 8.8 | 0.0033 | None reported |
Showing 1 to 8 of 8
1