JavaScript code running while transforming a document with the XSLTProcessor could lead to a use-after-free. This vulnerability was fixed in Firefox 137, Firefox ESR 115.22, Firefox ESR 128.9, Thunderbird 137, and Thunderbird 128.9.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade thunderbirdUpgrade firefox-x11Upgrade firefox | Apr 7, 2025 | Apr 1, 2025 |
| Amazon Linux Ami 2 | — | Upgrade thunderbirdUpgrade firefoxUpgrade thunderbird-debuginfoUpgrade firefox-debuginfo | Apr 30, 2025 | Apr 1, 2025 |
| Amazon_linux_2023 | — | Upgrade firefox-debugsourceUpgrade firefoxUpgrade firefox-debuginfo | Apr 30, 2025 | Apr 1, 2025 |
| Debian | — | Upgrade thunderbirdUpgrade firefox-esr | Apr 4, 2025 | Apr 1, 2025 |
| Freebsd | — | Upgrade librewolfUpgrade firefox-esrUpgrade thunderbirdUpgrade firefox | Apr 9, 2025 | Apr 7, 2025 |
| Gentoo Linux | — | Upgrade www-client/firefox.Upgrade mail-client/thunderbird.Upgrade www-client/firefox-bin.Upgrade mail-client/thunderbird-bin.Upgrade dev-lang/spidermonkey. | May 13, 2025 | Apr 1, 2025 |
| Mfsa2025 20 | — | Upgrade to Mozilla Firefox version 137.0 | Apr 2, 2025 | Apr 1, 2025 |
| Mfsa2025 21 | — | Upgrade to Mozilla Firefox ESR version 115.22 | Apr 2, 2025 | Apr 1, 2025 |
| Mfsa2025 22 | — | Upgrade to Mozilla Firefox ESR version 128.9 | Apr 2, 2025 | Apr 1, 2025 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 128.9 | Apr 2, 2025 | Apr 1, 2025 |
| Oracle_linux | — | Upgrade thunderbirdUpgrade firefox-x11Upgrade firefox | Apr 4, 2025 | Apr 1, 2025 |
| Redhat_linux | — | Upgrade firefox-debugsourceNo solution existsUpgrade thunderbird-debuginfoUpgrade thunderbird-debugsourceUpgrade firefox-debuginfoUpgrade thunderbirdUpgrade firefox-x11Upgrade firefox | Apr 4, 2025 | Apr 1, 2025 |
| Rocky_linux | — | Upgrade firefoxUpgrade firefox-debuginfoUpgrade thunderbirdUpgrade thunderbird-debuginfoUpgrade firefox-debugsourceUpgrade thunderbird-debugsource | Jul 31, 2025 | Jul 29, 2025 |
| Suse | — | Upgrade mozillathunderbird-translations-commonUpgrade mozjs128Upgrade mozillafirefox-develUpgrade mozillafirefox-translations-otherUpgrade mozillafirefox-branding-upstreamUpgrade mozillafirefoxUpgrade mozillathunderbird-translations-otherUpgrade mozjs128-develUpgrade libmozjs-128-0Upgrade mozillathunderbirdUpgrade mozillafirefox-translations-common | Apr 3, 2025 | Apr 1, 2025 |
| Ubuntu | — | Upgrade thunderbird | Jun 26, 2025 | Apr 1, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub