REDHAT-BUG-2336182
First published: Tue Jan 07 2025(Updated: )
The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could have led to privilege escalation attacks. This vulnerability affects Firefox < 134 and Firefox ESR < 128.6.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Firefox | <134 | |
| Firefox ESR | <128.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/errata/RHSA-2025:0080
- https://access.redhat.com/errata/RHSA-2025:0133
- https://access.redhat.com/errata/RHSA-2025:0135
- https://access.redhat.com/errata/RHSA-2025:0134
- https://access.redhat.com/errata/RHSA-2025:0132
- https://access.redhat.com/errata/RHSA-2025:0136
- https://access.redhat.com/errata/RHSA-2025:0138
- https://access.redhat.com/errata/RHSA-2025:0137
- https://access.redhat.com/errata/RHSA-2025:0144
- https://access.redhat.com/errata/RHSA-2025:0162
- https://bugzilla.redhat.com/show_bug.cgi?id=2336182
Frequently Asked Questions
What is the severity of REDHAT-BUG-2336182?
The severity of REDHAT-BUG-2336182 is critical due to the potential for privilege escalation attacks.
How do I fix REDHAT-BUG-2336182?
To fix REDHAT-BUG-2336182, upgrade your Firefox to version 134 or Firefox ESR to version 128.6 or later.
Which versions of Firefox are affected by REDHAT-BUG-2336182?
Firefox versions earlier than 134 and Firefox ESR versions earlier than 128.6 are affected by REDHAT-BUG-2336182.
Can REDHAT-BUG-2336182 lead to data breaches?
Yes, REDHAT-BUG-2336182 may lead to data breaches due to privilege escalation vulnerabilities.
Is there a workaround for REDHAT-BUG-2336182?
There are no official workarounds for REDHAT-BUG-2336182; the recommended action is to apply the necessary updates.
- agent/severity
- agent/first-publish-date
- agent/type
- agent/description
- agent/event
- agent/references
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2025-0237
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/mozilla
- canonical/firefox
- canonical/firefox esr