CVSS: 10.0EPSS: 0%CPEs: 33EXPL: 0CVE-2025-8035 – firefox: thunderbird: Memory safety bugs
https://notcve.org/view.php?id=CVE-2025-8035
22 Jul 2025 — Memory safety bugs present in Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 141, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and Thunderbird < 140.1. A flaw was found in Firefox and Thunderbird. The Mozil... • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1975961%2C1975961%2C1975961 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 0%CPEs: 19EXPL: 0CVE-2025-8040 – openSUSE Security Advisory - openSUSE-SU-2025:15386-1
https://notcve.org/view.php?id=CVE-2025-8040
22 Jul 2025 — Memory safety bugs present in Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1. These are all security issues fixed in the MozillaThunderbird-140.1.0-1.1 package on the GA media of openSUSE Tumbleweed. • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1975058%2C1975058%2C1975998%2C1975998 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 0%CPEs: 33EXPL: 0CVE-2025-8034 – firefox: thunderbird: Memory safety bugs
https://notcve.org/view.php?id=CVE-2025-8034
22 Jul 2025 — Memory safety bugs present in Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 141, Firefox ESR < 115.26, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and Thunderbird < 140.1. A flaw was f... • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1970422%2C1970422%2C1970422%2C1970422 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 0%CPEs: 19EXPL: 0CVE-2025-8038 – openSUSE Security Advisory - openSUSE-SU-2025:15386-1
https://notcve.org/view.php?id=CVE-2025-8038
22 Jul 2025 — Thunderbird ignored paths when checking the validity of navigations in a frame. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1. Firefox ignored paths when checking the validity of navigations in a frame. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1. These are all security issues fixed in the MozillaThunderbird-140.1.0-1.1 package on the GA media of openSUSE Tumbleweed. • https://bugzilla.mozilla.org/show_bug.cgi?id=1808979 • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 9.4EPSS: 0%CPEs: 19EXPL: 0CVE-2025-8036 – openSUSE Security Advisory - openSUSE-SU-2025:15386-1
https://notcve.org/view.php?id=CVE-2025-8036
22 Jul 2025 — Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1. Firefox cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. • https://bugzilla.mozilla.org/show_bug.cgi?id=1960834 • CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action •
CVSS: 9.4EPSS: 0%CPEs: 33EXPL: 0CVE-2025-8029 – firefox: thunderbird: javascript: URLs executed on object and embed tags
https://notcve.org/view.php?id=CVE-2025-8029
22 Jul 2025 — Thunderbird executed `javascript:` URLs when used in `object` and `embed` tags. This vulnerability affects Firefox < 141, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and Thunderbird < 140.1. Firefox executed `javascript:` URLs when used in `object` and `embed` tags. This vulnerability affects Firefox < 141, Firefox ESR < 128.13, Firefox ESR < 140.1, Thunderbird < 141, Thunderbird < 128.13, and Thunderbird < 140.1. A flaw was found in Firefox and Thunderbird. • https://bugzilla.mozilla.org/show_bug.cgi?id=1928021 • CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •
CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 0CVE-2025-48964 – SUSE Security Advisory - SUSE-SU-2025:02431-1
https://notcve.org/view.php?id=CVE-2025-48964
21 Jul 2025 — ping in iputils through 20240905 allows a denial of service (application error in adaptive ping mode or incorrect data collection) via a crafted ICMP Echo Reply packet, because a zero timestamp can lead to large intermediate values that have an integer overflow when squared during statistics calculations. NOTE: this issue exists because of an incomplete fix for CVE-2025-47268 (that fix was only about timestamp calculations, and it did not account for a specific scenario where the original timestamp in the I... • https://bugzilla.suse.com/show_bug.cgi?id=1243772 • CWE-190: Integer Overflow or Wraparound •
CVSS: 5.6EPSS: 0%CPEs: 12EXPL: 0CVE-2025-47806 – SUSE Security Advisory - SUSE-SU-2025:02302-1
https://notcve.org/view.php?id=CVE-2025-47806
14 Jul 2025 — In GStreamer through 1.26.1, the subparse plugin's parse_subrip_time function may write data past the bounds of a stack buffer, leading to a crash. En GStreamer hasta la versión 1.26.1, la función parse_subrip_time del complemento de subanálisis puede escribir datos más allá de los límites de un búfer de pila, lo que provoca un bloqueo. This update for gstreamer-plugins-base fixes the following issues. Fixed NULL-pointer dereference in TMPlayer subtitle parser. Fixed NULL-pointer dereference in SubRip subti... • https://github.com/atredispartners/advisories/blob/master/2025/ATREDIS-2025-0003.md • CWE-121: Stack-based Buffer Overflow •
CVSS: 5.5EPSS: 0%CPEs: 13EXPL: 0CVE-2025-47807 – SUSE Security Advisory - SUSE-SU-2025:02302-1
https://notcve.org/view.php?id=CVE-2025-47807
14 Jul 2025 — In GStreamer through 1.26.1, the subparse plugin's subrip_unescape_formatting function may dereference a NULL pointer while parsing a subtitle file, leading to a crash. En GStreamer hasta la versión 1.26.1, la función subrip_unescape_formatting del complemento de subanálisis puede desreferenciar un puntero NULL mientras analiza un archivo de subtítulos, lo que provoca un bloqueo. This update for gstreamer-plugins-base fixes the following issues. Fixed NULL-pointer dereference in TMPlayer subtitle parser. Fi... • https://github.com/atredispartners/advisories/blob/master/2025/ATREDIS-2025-0003.md • CWE-476: NULL Pointer Dereference •
CVSS: 5.6EPSS: 0%CPEs: 12EXPL: 0CVE-2025-47808 – SUSE Security Advisory - SUSE-SU-2025:02302-1
https://notcve.org/view.php?id=CVE-2025-47808
14 Jul 2025 — In GStreamer through 1.26.1, the subparse plugin's tmplayer_parse_line function may dereference a NULL pointer while parsing a subtitle file, leading to a crash. En GStreamer hasta la versión 1.26.1, la función tmplayer_parse_line del complemento de subanálisis puede desreferenciar un puntero NULL mientras analiza un archivo de subtítulos, lo que provoca un bloqueo. This update for gstreamer-plugins-base fixes the following issues. Fixed NULL-pointer dereference in TMPlayer subtitle parser. Fixed NULL-point... • https://github.com/atredispartners/advisories/blob/master/2025/ATREDIS-2025-0003.md • CWE-476: NULL Pointer Dereference •