REDHAT-BUG-2362904
First published: Tue Apr 29 2025(Updated: )
A vulnerability was identified in Firefox where XPath parsing could trigger undefined behavior due to missing null checks during attribute access. This could lead to out-of-bounds read access and potentially, memory corruption. This vulnerability affects Firefox < 138, Firefox ESR < 128.10, Thunderbird < 138, and Thunderbird ESR < 128.10.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Firefox | <138 | |
| Firefox ESR | <128.10 | |
| Thunderbird | <138 | |
| Mozilla Thunderbird | <128.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/errata/RHSA-2025:4443
- https://access.redhat.com/errata/RHSA-2025:4458
- https://access.redhat.com/errata/RHSA-2025:4460
- https://access.redhat.com/errata/RHSA-2025:4753
- https://access.redhat.com/errata/RHSA-2025:4756
- https://access.redhat.com/errata/RHSA-2025:4751
- https://access.redhat.com/errata/RHSA-2025:4752
- https://bugzilla.redhat.com/show_bug.cgi?id=2362904
Frequently Asked Questions
What is the severity of REDHAT-BUG-2362904?
The severity of REDHAT-BUG-2362904 is critical due to the potential for memory corruption and out-of-bounds read access.
How do I fix REDHAT-BUG-2362904?
To fix REDHAT-BUG-2362904, upgrade to Firefox version 138 or higher, Firefox ESR version 128.10 or higher, or equivalent updates for Thunderbird.
Which versions are affected by REDHAT-BUG-2362904?
REDHAT-BUG-2362904 affects Firefox versions below 138, Firefox ESR versions below 128.10, and their corresponding Thunderbird versions.
What types of products are impacted by REDHAT-BUG-2362904?
REDHAT-BUG-2362904 affects Mozilla Firefox, Firefox ESR, Thunderbird, and Thunderbird ESR.
What are the potential risks associated with REDHAT-BUG-2362904?
The potential risks include undefined behavior that could lead to memory corruption, which may expose or compromise user data.
- agent/last-modified-date
- agent/source
- agent/references
- agent/severity
- agent/type
- agent/description
- agent/first-publish-date
- agent/event
- agent/guess-ai
- agent/software-canonical-lookup
- agent/tags
- agent/softwarecombine
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2025-4087
- vendor/mozilla
- canonical/firefox
- canonical/firefox esr
- canonical/thunderbird
- canonical/mozilla thunderbird