firefox-128.13.0-1.0.1.el7.AXS7

Mozilla Firefox is an open-source web browser, designed for standards
compliance, performance, and portability.

Security Fix(es):

* firefox: thunderbird: Large branch table could lead to truncated instruction
(CVE-2025-8028)
* firefox: thunderbird: Memory safety bugs (CVE-2025-8035)
* firefox: thunderbird: Incorrect URL stripping in CSP reports (CVE-2025-8031)
* firefox: thunderbird: JavaScript engine only wrote partial return value to
stack (CVE-2025-8027)
* firefox: thunderbird: Potential user-assisted code execution in ?Copy as
cURL? command (CVE-2025-8030)
* firefox: Memory safety bugs (CVE-2025-8034)
* firefox: thunderbird: Incorrect JavaScript state machine for generators
(CVE-2025-8033)
* firefox: thunderbird: XSLT documents could bypass CSP (CVE-2025-8032)
* firefox: thunderbird: javascript: URLs executed on object and embed tags
(CVE-2025-8029)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

CVE-2025-8027
On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value
space on the stack. Baseline-JIT, however, read the entire 64 bits. This
vulnerability affects Firefox < 141, Firefox ESR < 115.26, Firefox ESR < 128.13,
Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and Thunderbird <
140.1.
CVE-2025-8028
On arm64, a WASM `br_table` instruction with a lot of entries could lead to the
label being too far from the instruction causing truncation and incorrect
computation of the branch address. This vulnerability affects Firefox < 141,
Firefox ESR < 115.26, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird <
141, Thunderbird < 128.13, and Thunderbird < 140.1.
CVE-2025-8029
Thunderbird executed `javascript:` URLs when used in `object` and `embed` tags.
This vulnerability affects Firefox < 141, Firefox ESR < 128.13, Firefox ESR <
140.1, Thunderbird < 141, Thunderbird < 128.13, and Thunderbird < 140.1.
CVE-2025-8030
Insufficient escaping in the “Copy as cURL” feature could potentially be used to
trick a user into executing unexpected code. This vulnerability affects Firefox
< 141, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141, Thunderbird
< 128.13, and Thunderbird < 140.1.
CVE-2025-8031
The `username:password` part was not correctly stripped from URLs in CSP reports
potentially leaking HTTP Basic Authentication credentials. This vulnerability
affects Firefox < 141, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird <
141, Thunderbird < 128.13, and Thunderbird < 140.1.
CVE-2025-8032
XSLT document loading did not correctly propagate the source document which
bypassed its CSP. This vulnerability affects Firefox < 141, Firefox ESR <
128.13, Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and
Thunderbird < 140.1.
CVE-2025-8033
The JavaScript engine did not handle closed generators correctly and it was
possible to resume them leading to a nullptr deref. This vulnerability affects
Firefox < 141, Firefox ESR < 115.26, Firefox ESR < 128.13, Firefox ESR < 140.1,
Thunderbird < 141, Thunderbird < 128.13, and Thunderbird < 140.1.
CVE-2025-8034
Memory safety bugs present in Firefox ESR 115.25, Firefox ESR 128.12,
Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140
and Thunderbird 140. Some of these bugs showed evidence of memory corruption and
we presume that with enough effort some of these could have been exploited to
run arbitrary code. This vulnerability affects Firefox < 141, Firefox ESR <
115.26, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141,
Thunderbird < 128.13, and Thunderbird < 140.1.
CVE-2025-8035
Memory safety bugs present in Firefox ESR 128.12, Thunderbird ESR 128.12,
Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some
of these bugs showed evidence of memory corruption and we presume that with
enough effort some of these could have been exploited to run arbitrary code.
This vulnerability affects Firefox < 141, Firefox ESR < 128.13, Firefox ESR <
140.1, Thunderbird < 141, Thunderbird < 128.13, and Thunderbird < 140.1.