红帽产品勘误 RHSA-2025:16260 - Security Advisory
发布：
2025-09-22
已更新：
2025-09-22

RHSA-2025:16260 - Security Advisory

概述

Important: firefox security update

类型/严重性

Security Advisory: Important

Red Hat Insights 补丁分析

识别并修复受此公告影响的系统。

查看受影响的系统

标题

An update for firefox is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

描述

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

  • firefox: thunderbird: Sandbox escape due to use-after-free in the Graphics: Canvas2D component (CVE-2025-10527)
  • firefox: thunderbird: Incorrect boundary conditions in the JavaScript: GC component (CVE-2025-10532)
  • firefox: thunderbird: Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component (CVE-2025-10528)
  • firefox: thunderbird: Same-origin policy bypass in the Layout component (CVE-2025-10529)
  • firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143 (CVE-2025-10537)
  • firefox: thunderbird: Information disclosure in the Networking: Cache component (CVE-2025-10536)
  • firefox: thunderbird: Integer overflow in the SVG component (CVE-2025-10533)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

解决方案

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

受影响的产品

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 8 aarch64

修复

  • BZ - 2395745 - CVE-2025-10527 firefox: thunderbird: Sandbox escape due to use-after-free in the Graphics: Canvas2D component
  • BZ - 2395754 - CVE-2025-10532 firefox: thunderbird: Incorrect boundary conditions in the JavaScript: GC component
  • BZ - 2395755 - CVE-2025-10528 firefox: thunderbird: Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component
  • BZ - 2395756 - CVE-2025-10529 firefox: thunderbird: Same-origin policy bypass in the Layout component
  • BZ - 2395759 - CVE-2025-10537 firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143
  • BZ - 2395764 - CVE-2025-10536 firefox: thunderbird: Information disclosure in the Networking: Cache component
  • BZ - 2395766 - CVE-2025-10533 firefox: thunderbird: Integer overflow in the SVG component

Red Hat Enterprise Linux for x86_64 8

SRPM
firefox-140.3.0-1.el8_10.src.rpm SHA-256: 686703fc8c490a7ce6010a2874ac43ac2611aca6832cce08c2389c2d1576f3b2
x86_64
firefox-140.3.0-1.el8_10.x86_64.rpm SHA-256: 6dbbb7a24df370c4bbbee51ca5c68547383b5897e196629bbe25d07e4936bf3b
firefox-debuginfo-140.3.0-1.el8_10.x86_64.rpm SHA-256: 78f950a17a6cb4338e6e647549d3f202754631ec0203906f16a2b411f818e02f
firefox-debugsource-140.3.0-1.el8_10.x86_64.rpm SHA-256: 775ecd7304366b0b76674723f72cd265f26be598988721d1645a47bf6b1ce1f6

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
firefox-140.3.0-1.el8_10.src.rpm SHA-256: 686703fc8c490a7ce6010a2874ac43ac2611aca6832cce08c2389c2d1576f3b2
s390x
firefox-140.3.0-1.el8_10.s390x.rpm SHA-256: f6cdde21757d5cb6ef0961c61d1ec853543276d50482e970ada9298fdf041625
firefox-debuginfo-140.3.0-1.el8_10.s390x.rpm SHA-256: 94bda57c73dae37f0b6203f751d456238ac82fceddc0c4cf4b2be523316a9cab
firefox-debugsource-140.3.0-1.el8_10.s390x.rpm SHA-256: cb8f46248b2781f49b4a47247036335419288edb9a07406877e9e2e5650092c2

Red Hat Enterprise Linux for Power, little endian 8

SRPM
firefox-140.3.0-1.el8_10.src.rpm SHA-256: 686703fc8c490a7ce6010a2874ac43ac2611aca6832cce08c2389c2d1576f3b2
ppc64le
firefox-140.3.0-1.el8_10.ppc64le.rpm SHA-256: 54af0daf9c8ec1a9bd7a5e981d822e11ba57f3f96b419e4472f3e3bddfaff5a6
firefox-debuginfo-140.3.0-1.el8_10.ppc64le.rpm SHA-256: a26810f21694a0933fa9f1ab8a945762421e3133b535d8e4eed2d046e8ed2f7f
firefox-debugsource-140.3.0-1.el8_10.ppc64le.rpm SHA-256: 6f67e0004b6d305e2e0a74c923d50dcee35d91cdeb12190d2af2bf0650084377

Red Hat Enterprise Linux for ARM 64 8

SRPM
firefox-140.3.0-1.el8_10.src.rpm SHA-256: 686703fc8c490a7ce6010a2874ac43ac2611aca6832cce08c2389c2d1576f3b2
aarch64
firefox-140.3.0-1.el8_10.aarch64.rpm SHA-256: 2a8f248d638b3829b767ec949e341a17821c2a5533f98cb46a44a7848da384aa
firefox-debuginfo-140.3.0-1.el8_10.aarch64.rpm SHA-256: b3fa68513f2db0cf530164f14c1214b4791c0e6bfaf123c30749229a517b993f
firefox-debugsource-140.3.0-1.el8_10.aarch64.rpm SHA-256: 99cb756f90c9e8ef1713b0c9aa06fd8a07abd0cb965647435219972e1a075524

Red Hat 安全团队联络方式为 secalert@redhat.com。 更多联络细节请参考 https://access.redhat.com/security/team/contact/。