MFSA-RESERVE-2025-3
First published: Tue Apr 29 2025(Updated: )
Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Firefox | <138 | 138 |
| Mozilla Thunderbird | <128.10 | 128.10 |
| Firefox ESR | <128.10 | 128.10 |
| Thunderbird | <138 | 138 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=1951161%2C1952105
- https://www.mozilla.org/en-US/security/advisories/mfsa2025-28/
- https://www.mozilla.org/en-US/security/advisories/mfsa2025-32/
- https://www.mozilla.org/en-US/security/advisories/mfsa2025-29/
- https://www.mozilla.org/en-US/security/advisories/mfsa2025-31/
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is the severity of MFSA-RESERVE-2025-3?
The severity is considered high due to potential memory corruption that could allow execution of arbitrary code.
How do I fix MFSA-RESERVE-2025-3?
To fix MFSA-RESERVE-2025-3, update to Firefox version 138 or Thunderbird versions 128.10 or 138.
What products are affected by MFSA-RESERVE-2025-3?
Affected products include Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird ESR 128.9.
What types of issues are associated with MFSA-RESERVE-2025-3?
MFSA-RESERVE-2025-3 is associated with memory safety bugs that may lead to memory corruption.
Can MFSA-RESERVE-2025-3 be exploited?
Yes, with sufficient effort, some memory safety bugs in MFSA-RESERVE-2025-3 could potentially be exploited.
- collector/mozilla-advisory
- source/Mozilla
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/references
- agent/source
- agent/tags
- agent/severity
- agent/description
- agent/first-publish-date
- agent/type
- agent/softwarecombine
- agent/event
- vendor/mozilla
- canonical/firefox
- canonical/mozilla thunderbird
- canonical/firefox esr
- canonical/thunderbird