Linux · SUSE Linux Enterprise · Security advisory · November 24, 2025
SUSE-SU-2025:4173-1: MozillaFirefox security update
SUSE-SU-2025:4173-1, released November 24, 2025, fixes 17 CVEs in MozillaFirefox (version 140.5.0-150200.152.210.1). None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
17
None rated Critical
Exploited
0
None reported
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.0051
43rd percentile
Priority of the 17 CVEs
Patch now 0
Urgent 0
High 17
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| MozillaFirefox | opensuse-leap 15.6 | 140.5.0-150200.152.210.1 |
| MozillaFirefox | sles 15.6 | 140.5.0-150200.152.210.1 |
| MozillaFirefox | sles 15.7 | 140.5.0-150200.152.210.1 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| High | CVE-2025-11708 | Use-after-free in MediaTrackGraphImpl::GetInstance() | 9.8 | 0.0051 | None reported |
| High | CVE-2025-11709 | Out of bounds read/write in a privileged process triggered by WebGL textures | 9.8 | 0.0042 | None reported |
| High | CVE-2025-11710 | Cross-process information leaked due to malicious IPC messages | 9.8 | 0.0042 | None reported |
| High | CVE-2025-13016 | Incorrect boundary conditions in the JavaScript: WebAssembly component | 7.5 | 0.0041 | None reported |
| High | CVE-2025-11714 | Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144 | 8.8 | 0.0034 | None reported |
| High | CVE-2025-11715 | Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144 | 8.8 | 0.0033 | None reported |
| High | CVE-2025-13014 | Use-after-free in the Audio/Video component | 8.8 | 0.0032 | None reported |
| High | CVE-2025-13020 | Use-after-free in the WebRTC: Audio/Video component | 8.8 | 0.0031 | None reported |
| High | CVE-2025-11713 | Potential user-assisted code execution in “Copy as cURL” command | 8.1 | 0.0029 | None reported |
| High | CVE-2025-13017 | Same-origin policy bypass in the DOM: Notifications component | 8.1 | 0.0028 | None reported |
| High | CVE-2025-13018 | Mitigation bypass in the DOM: Security component | 8.1 | 0.0028 | None reported |
| High | CVE-2025-13019 | Same-origin policy bypass in the DOM: Workers component | 8.1 | 0.0028 | None reported |
| High | CVE-2025-13012 | Race condition in the Graphics component | 7.5 | 0.0024 | None reported |
| High | CVE-2025-11711 | Some non-writable Object properties could be modified | 7.5 | 0.0023 | None reported |
| High | CVE-2025-13015 | Spoofing issue in Firefox | 7.5 | 0.0023 | None reported |
| High | CVE-2025-11712 | An OBJECT tag type attribute overrode browser behavior on web resources without a content-type | 7.5 | 0.0022 | None reported |
| High | CVE-2025-13013 | Mitigation bypass in the DOM: Core & HTML component | 7.5 | 0.0022 | None reported |
Showing 1 to 17 of 17
1
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.