Search for vulnerabilities
Vulnerability details: VCID-eu9b-fb1a-hfax
Vulnerability ID VCID-eu9b-fb1a-hfax
Aliases CVE-2025-1937
Summary firefox: thunderbird: Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
System Score Found at
cvssv3 8.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-1937.json
epss 0.00099 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00099 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00099 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00099 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00099 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00102 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00102 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00102 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00102 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00102 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00102 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00102 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00102 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00102 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00102 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00102 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00102 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00102 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00102 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00102 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00102 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00102 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00102 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00102 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00102 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00102 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00102 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00102 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00106 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00117 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00122 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00122 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00122 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00122 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00122 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00122 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00122 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00122 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00122 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
epss 0.00122 https://api.first.org/data/v1/epss?cve=CVE-2025-1937
cvssv3.1 7.5 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1938471%2C1940716
ssvc Track https://bugzilla.mozilla.org/buglist.cgi?bug_id=1938471%2C1940716
cvssv3.1 8.8 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2025-14
generic_textual critical https://www.mozilla.org/en-US/security/advisories/mfsa2025-15
generic_textual critical https://www.mozilla.org/en-US/security/advisories/mfsa2025-16
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2025-17
generic_textual critical https://www.mozilla.org/en-US/security/advisories/mfsa2025-18
cvssv3.1 7.5 https://www.mozilla.org/security/advisories/mfsa2025-14/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-14/
cvssv3.1 7.5 https://www.mozilla.org/security/advisories/mfsa2025-15/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-15/
cvssv3.1 7.5 https://www.mozilla.org/security/advisories/mfsa2025-16/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-16/
cvssv3.1 7.5 https://www.mozilla.org/security/advisories/mfsa2025-17/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-17/
cvssv3.1 7.5 https://www.mozilla.org/security/advisories/mfsa2025-18/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-18/
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-1937.json
https://api.first.org/data/v1/epss?cve=CVE-2025-1937
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1937
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
http://www.openwall.com/lists/oss-security/2025/03/10/6
2349795 https://bugzilla.redhat.com/show_bug.cgi?id=2349795
buglist.cgi?bug_id=1938471%2C1940716 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1938471%2C1940716
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
CVE-2025-1937 https://nvd.nist.gov/vuln/detail/CVE-2025-1937
GLSA-202505-02 https://security.gentoo.org/glsa/202505-02
GLSA-202505-03 https://security.gentoo.org/glsa/202505-03
GLSA-202505-08 https://security.gentoo.org/glsa/202505-08
mfsa2025-14 https://www.mozilla.org/en-US/security/advisories/mfsa2025-14
mfsa2025-14 https://www.mozilla.org/security/advisories/mfsa2025-14/
mfsa2025-15 https://www.mozilla.org/en-US/security/advisories/mfsa2025-15
mfsa2025-15 https://www.mozilla.org/security/advisories/mfsa2025-15/
mfsa2025-16 https://www.mozilla.org/en-US/security/advisories/mfsa2025-16
mfsa2025-16 https://www.mozilla.org/security/advisories/mfsa2025-16/
mfsa2025-17 https://www.mozilla.org/en-US/security/advisories/mfsa2025-17
mfsa2025-17 https://www.mozilla.org/security/advisories/mfsa2025-17/
mfsa2025-18 https://www.mozilla.org/en-US/security/advisories/mfsa2025-18
mfsa2025-18 https://www.mozilla.org/security/advisories/mfsa2025-18/
RHSA-2025:2359 https://access.redhat.com/errata/RHSA-2025:2359
RHSA-2025:2452 https://access.redhat.com/errata/RHSA-2025:2452
RHSA-2025:2479 https://access.redhat.com/errata/RHSA-2025:2479
RHSA-2025:2480 https://access.redhat.com/errata/RHSA-2025:2480
RHSA-2025:2481 https://access.redhat.com/errata/RHSA-2025:2481
RHSA-2025:2484 https://access.redhat.com/errata/RHSA-2025:2484
RHSA-2025:2485 https://access.redhat.com/errata/RHSA-2025:2485
RHSA-2025:2486 https://access.redhat.com/errata/RHSA-2025:2486
RHSA-2025:2699 https://access.redhat.com/errata/RHSA-2025:2699
RHSA-2025:2708 https://access.redhat.com/errata/RHSA-2025:2708
RHSA-2025:2899 https://access.redhat.com/errata/RHSA-2025:2899
RHSA-2025:2900 https://access.redhat.com/errata/RHSA-2025:2900
RHSA-2025:2957 https://access.redhat.com/errata/RHSA-2025:2957
RHSA-2025:2958 https://access.redhat.com/errata/RHSA-2025:2958
RHSA-2025:2959 https://access.redhat.com/errata/RHSA-2025:2959
RHSA-2025:2960 https://access.redhat.com/errata/RHSA-2025:2960
RHSA-2025:3009 https://access.redhat.com/errata/RHSA-2025:3009
RHSA-2025:3013 https://access.redhat.com/errata/RHSA-2025:3013
RHSA-2025:3036 https://access.redhat.com/errata/RHSA-2025:3036
USN-7334-1 https://usn.ubuntu.com/7334-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-1937.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://bugzilla.mozilla.org/buglist.cgi?bug_id=1938471%2C1940716
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-03-06T04:55:10Z/ Found at https://bugzilla.mozilla.org/buglist.cgi?bug_id=1938471%2C1940716
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.mozilla.org/security/advisories/mfsa2025-14/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-03-06T04:55:10Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-14/
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.mozilla.org/security/advisories/mfsa2025-15/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-03-06T04:55:10Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-15/
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.mozilla.org/security/advisories/mfsa2025-16/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-03-06T04:55:10Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-16/
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.mozilla.org/security/advisories/mfsa2025-17/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-03-06T04:55:10Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-17/
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.mozilla.org/security/advisories/mfsa2025-18/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-03-06T04:55:10Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-18/
Exploit Prediction Scoring System (EPSS)
Percentile 0.24755
EPSS Score 0.00099
Published At March 28, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-03-28T05:41:59.974799+00:00 RedHat Importer Import https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-1937.json 36.0.0