REDHAT-BUG-2362907
First published: Tue Apr 29 2025(Updated: )
A process isolation vulnerability in Firefox stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document's process instead of the intended frame, potentially enabling a sandbox escape. This vulnerability affects Firefox < 138, Firefox ESR < 128.10, Firefox ESR < 115.23, Thunderbird < 138, and Thunderbird ESR < 128.10.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Firefox | <138 | |
| Firefox ESR | <128.10<115.23 | |
| Thunderbird | <138 | |
| Mozilla Thunderbird | <128.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/errata/RHSA-2025:4443
- https://access.redhat.com/errata/RHSA-2025:4458
- https://access.redhat.com/errata/RHSA-2025:4460
- https://access.redhat.com/errata/RHSA-2025:4753
- https://access.redhat.com/errata/RHSA-2025:4756
- https://access.redhat.com/errata/RHSA-2025:4751
- https://access.redhat.com/errata/RHSA-2025:4752
- https://bugzilla.redhat.com/show_bug.cgi?id=2362907
Frequently Asked Questions
What is the severity of REDHAT-BUG-2362907?
The severity of REDHAT-BUG-2362907 is considered high due to the potential for sandbox escape.
How do I fix REDHAT-BUG-2362907?
To address REDHAT-BUG-2362907, update Firefox or Thunderbird to the latest version that exceeds the affected versions.
Which versions are affected by REDHAT-BUG-2362907?
REDHAT-BUG-2362907 affects Firefox versions below 138 and Thunderbird versions below 138.
What are the impacts of REDHAT-BUG-2362907 on system security?
The impact of REDHAT-BUG-2362907 includes unauthorized execution of content in a user's browser, leading to potential data compromise.
Is REDHAT-BUG-2362907 specific to certain browsers?
Yes, REDHAT-BUG-2362907 specifically affects Mozilla Firefox and Thunderbird.
- agent/last-modified-date
- agent/source
- agent/references
- agent/severity
- agent/type
- agent/description
- agent/first-publish-date
- agent/event
- agent/guess-ai
- agent/software-canonical-lookup
- agent/tags
- agent/softwarecombine
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2025-4083
- vendor/mozilla
- canonical/firefox
- canonical/firefox esr
- canonical/thunderbird
- canonical/mozilla thunderbird