CVE-2025-1936 Affecting firefox package, versions <0:128.8.0-1.el9_5


Severity

Recommended
high

Based on AlmaLinux security rating.

Threat Intelligence

EPSS
0.05% (19th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ALMALINUX9-FIREFOX-9509751
  • published22 Mar 2025
  • disclosed5 Mar 2025

Introduced: 5 Mar 2025

NewCVE-2025-1936  (opens in a new tab)

How to fix?

Upgrade AlmaLinux:9 firefox to version 0:128.8.0-1.el9_5 or higher.
This issue was patched in ALSA-2025:2359.

NVD Description

Note: Versions mentioned in the description apply only to the upstream firefox package and not the firefox package as distributed by AlmaLinux. See How to fix? for AlmaLinux:9 relevant fixed versions and status.

jar: URLs retrieve local file content packaged in a ZIP archive. The null and everything after it was ignored when retrieving the content from the archive, but the fake extension after the null was used to determine the type of content. This could have been used to hide code in a web extension disguised as something else like an image. This vulnerability affects Firefox < 136, Firefox ESR < 128.8, Thunderbird < 136, and Thunderbird < 128.8.

CVSS Base Scores

version 3.1