The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Due to insufficient escaping of the special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. *This bug only affects Firefox for Windows. Other versions of Firefox are unaffected.*. This vulnerability was fixed in Firefox ESR 128.10, Firefox ESR 115.23, and Thunderbird 128.10.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Mfsa2025 29 | — | Upgrade to Mozilla Firefox ESR version 128.10Upgrade to the latest version of Mozilla Firefox | Apr 30, 2025 | Apr 29, 2025 |
| Mfsa2025 30 | — | Upgrade to the latest version of Mozilla FirefoxUpgrade to Mozilla Firefox ESR version 115.23 | Apr 30, 2025 | Apr 29, 2025 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 128.10Upgrade to the latest version of Mozilla Thunderbird | Apr 30, 2025 | Apr 29, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 29, 2025 |
| Suse | — | Upgrade mozillafirefox-branding-upstreamUpgrade MozillaThunderbirdUpgrade MozillaFirefox-develUpgrade MozillaThunderbird-translations-commonUpgrade MozillaFirefox-translations-otherUpgrade MozillaThunderbird-translations-otherUpgrade MozillaFirefoxUpgrade MozillaFirefox-translations-common | May 5, 2025 | Apr 29, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub