CVE-2025-1012: Use-after-free during concurrent delazification

Q: What is the severity of CVE-2025-1012?

CVE-2025-1012 is classified as a critical vulnerability due to potential use-after-free conditions.

Q: How do I fix CVE-2025-1012?

To fix CVE-2025-1012, update to the latest version of Firefox or Thunderbird as specified in the advisory.

Q: Which software versions are affected by CVE-2025-1012?

CVE-2025-1012 affects Firefox versions below 135, Firefox ESR versions below 115.20, and Thunderbird versions below 135.

Q: What kind of threat does CVE-2025-1012 pose?

CVE-2025-1012 poses a threat of exploitation through use-after-free vulnerabilities during concurrent operations.

Q: Is CVE-2025-1012 currently being actively exploited?

At this time, there are no public reports indicating that CVE-2025-1012 is being actively exploited in the wild.

Published Feb 4, 2025

Updated

A race during concurrent delazification could have led to a use-after-free.

Affected Software

24 affected componentsFixes available

Mozilla Firefox<135

135

Mozilla Firefox ESR<128.7

128.7

Mozilla Firefox ESR<115.20

115.20

Mozilla Thunderbird<135

135

Mozilla Firefox<115.20.0

Mozilla Firefox<135.0

Mozilla Firefox>=128.1.0<128.7.0

Mozilla Thunderbird<135.0

Mozilla Thunderbird>=128.0.1<128.7.0

ubuntu/mozjs52*

ubuntu/mozjs38*

ubuntu/firefox<135.0+build2-0ubuntu0.20.04.1

135.0+build2-0ubuntu0.20.04.1

ubuntu/mozjs68*

ubuntu/mozjs52*

ubuntu/mozjs102*

ubuntu/mozjs78*

ubuntu/mozjs91*

ubuntu/thunderbird<1:128.12.0+build1-0ubuntu0.22.04.1

1:128.12.0+build1-0ubuntu0.22.04.1

ubuntu/mozjs102*

ubuntu/mozjs115*

Mozilla Thunderbird<128.7

128.7

debian/firefox

159.0-1

debian/firefox-esr

140.12.0esr-1~deb12u1153.6.0esr-1~deb12u2140.15.0esr-1~deb13u1153.6.0esr-1~deb13u1153.5.1esr-1153.6.0esr-1

debian/thunderbird

1:140.12.0esr-1~deb12u11:153.6.0esr-1~deb12u11:140.12.0esr-1~deb13u11:153.5.1esr-1~deb13u21:153.5.0esr-11:153.6.0esr-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Firefox to a version that resolves this vulnerability.
Fixed in 135
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 128.7
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 115.20
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 135
Upgrade
Upgrade ubuntu/firefox to a version that resolves this vulnerability.
Fixed in 135.0+build2-0ubuntu0.20.04.1
Upgrade
Upgrade ubuntu/thunderbird to a version that resolves this vulnerability.
Fixed in 1:128.12.0+build1-0ubuntu0.22.04.1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 128.7
Upgrade
Upgrade debian/firefox to a version that resolves this vulnerability.
Fixed in 159.0-1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 140.12.0esr-1~deb12u1Fixed in 153.6.0esr-1~deb12u2Fixed in 140.15.0esr-1~deb13u1Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.6.0esr-1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u1Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.5.1esr-1~deb13u2Fixed in 1:153.5.0esr-1Fixed in 1:153.6.0esr-1
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 128.7

Event History

Feb 4, 2025

CVE Published

via Mozilla·12:00 AM

Data Sourced

via Mozilla·12:00 AM

DescriptionSeverityAffected Software

CVE Published

via MITRE·01:58 PM

Data Sourced

via MITRE·01:58 PM

Description

Data Sourced

via NVD·02:15 PM

DescriptionSeverityWeaknessAffected Software

Data Sourced

via Red Hat·03:02 PM

DescriptionSeverityAffected Software

Feb 6, 2025

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Data Sourced

via Ubuntu·12:00 AM

RemedyDescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2025-1012?

CVE-2025-1012 is classified as a critical vulnerability due to potential use-after-free conditions.

How do I fix CVE-2025-1012?

To fix CVE-2025-1012, update to the latest version of Firefox or Thunderbird as specified in the advisory.

Which software versions are affected by CVE-2025-1012?

CVE-2025-1012 affects Firefox versions below 135, Firefox ESR versions below 115.20, and Thunderbird versions below 135.

What kind of threat does CVE-2025-1012 pose?

CVE-2025-1012 poses a threat of exploitation through use-after-free vulnerabilities during concurrent operations.

Is CVE-2025-1012 currently being actively exploited?

At this time, there are no public reports indicating that CVE-2025-1012 is being actively exploited in the wild.

CVE-2025-1012: Use-after-free during concurrent delazification

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2025-1012?

How do I fix CVE-2025-1012?

Which software versions are affected by CVE-2025-1012?

What kind of threat does CVE-2025-1012 pose?

Is CVE-2025-1012 currently being actively exploited?

Company

Resources

Contact