Bug 2368752 (CVE-2025-5268)

Summary: CVE-2025-5268 firefox: thunderbird: Memory safety bugs
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: erack, gotiwari, jhorak, mvyas, tpopela
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Some memory bugs show evidence of memory corruption, and we presume that with enough effort, some of these could be exploited to run arbitrary code.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-05-27 13:01:26 UTC
Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 139 and Firefox ESR < 128.11.

Comment 1 errata-xmlrpc 2025-05-29 07:11:20 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:8293 https://access.redhat.com/errata/RHSA-2025:8293

Comment 2 errata-xmlrpc 2025-05-29 11:26:44 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:8308 https://access.redhat.com/errata/RHSA-2025:8308

Comment 3 errata-xmlrpc 2025-06-02 02:10:07 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2025:8341 https://access.redhat.com/errata/RHSA-2025:8341

Comment 4 errata-xmlrpc 2025-06-05 12:23:43 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2025:8598 https://access.redhat.com/errata/RHSA-2025:8598

Comment 5 errata-xmlrpc 2025-06-05 12:29:54 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2025:8599 https://access.redhat.com/errata/RHSA-2025:8599

Comment 6 errata-xmlrpc 2025-06-05 17:13:33 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2025:8608 https://access.redhat.com/errata/RHSA-2025:8608

Comment 7 errata-xmlrpc 2025-06-05 18:54:42 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:8607 https://access.redhat.com/errata/RHSA-2025:8607