USN-7263-1: Firefox vulnerabilities
11 February 2025
Several security issues were fixed in Firefox.
Releases
Packages
- firefox - Mozilla Open Source web browser
Details
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across domains, or execute arbitrary code. (CVE-2025-1011,
CVE-2025-1013, CVE-2025-1014, CVE-2025-1016, CVE-2025-1017, CVE-2025-1018,
CVE-2025-1019, CVE-2025-1020)
Ivan Fratric discovered that Firefox did not properly handle XSLT data,
leading to a use-after-free vulnerability. An attacker could potentially
exploit this issue to cause a denial of service, or execute arbitrary code.
(CVE-2025-1009)
Atte Kettunen discovered that Firefox did not properly manage memory in
the Custom Highlight API, leading to a use-after-free vulnerability. An
attacker could potentially exploit this issue to cause a denial of service,
or execute arbitrary code. (CVE-2025-1010)
Nils Bars discovered that Firefox did not properly manage memory during
concurrent delazification, leading to a use-after-free vulnerability.
An attacker could potentially exploit this issue to cause a denial of
service, or execute arbitrary code. (CVE-2025-1012)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 20.04
After a standard system update you need to restart Firefox to make all the
necessary changes