CVE-2025-1013 Affecting firefox-esr package, versions *
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-DEBIAN13-FIREFOXESR-8688039
- published5 Feb 2025
- disclosed4 Feb 2025
Introduced: 4 Feb 2025
NewCVE-2025-1013 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
How to fix?
There is no fixed version for Debian:13 firefox-esr.
NVD Description
Note: Versions mentioned in the description apply only to the upstream firefox-esr package and not the firefox-esr package as distributed by Debian.
See How to fix? for Debian:13 relevant fixed versions and status.
A race condition could have led to private browsing tabs being opened in normal browsing windows. This could have resulted in a potential privacy leak. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.
References
- https://security-tracker.debian.org/tracker/CVE-2025-1013
- https://bugzilla.mozilla.org/show_bug.cgi?id=1932555
- https://www.mozilla.org/security/advisories/mfsa2025-07/
- https://www.mozilla.org/security/advisories/mfsa2025-09/
- https://www.mozilla.org/security/advisories/mfsa2025-10/
- https://www.mozilla.org/security/advisories/mfsa2025-11/