REDHAT-BUG-2362915
First published: Tue Apr 29 2025(Updated: )
Memory safety bug present in Firefox ESR 128.9, and Thunderbird 128.9. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 128.10 and Thunderbird ESR < 128.10.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Firefox ESR | <128.10 | |
| Thunderbird | <128.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/errata/RHSA-2025:4443
- https://access.redhat.com/errata/RHSA-2025:4458
- https://access.redhat.com/errata/RHSA-2025:4460
- https://access.redhat.com/errata/RHSA-2025:4753
- https://access.redhat.com/errata/RHSA-2025:4756
- https://access.redhat.com/errata/RHSA-2025:4751
- https://access.redhat.com/errata/RHSA-2025:4752
- https://bugzilla.redhat.com/show_bug.cgi?id=2362915
Frequently Asked Questions
What is the severity of REDHAT-BUG-2362915?
The severity of REDHAT-BUG-2362915 is considered high due to evidence of memory corruption that could potentially allow for arbitrary code execution.
How do I fix REDHAT-BUG-2362915?
To fix REDHAT-BUG-2362915, update to Firefox ESR 128.10 and Thunderbird ESR 128.10 or later.
What versions of Firefox and Thunderbird are affected by REDHAT-BUG-2362915?
Firefox ESR versions lower than 128.10 and Thunderbird ESR versions lower than 128.10 are affected by REDHAT-BUG-2362915.
Is there a workaround for REDHAT-BUG-2362915?
There are no recommended workarounds for REDHAT-BUG-2362915; the best action is to apply the update.
Can REDHAT-BUG-2362915 be exploited?
While exploitation of REDHAT-BUG-2362915 is not confirmed, the evidence of memory corruption suggests that it could potentially be exploited with sufficient effort.
- agent/last-modified-date
- agent/source
- agent/references
- agent/severity
- agent/type
- agent/description
- agent/first-publish-date
- agent/event
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/tags
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2025-4093
- vendor/mozilla
- canonical/firefox esr
- canonical/thunderbird