Search for vulnerabilities
Vulnerability details: VCID-gsn9-8cjh-dbc3
Vulnerability ID VCID-gsn9-8cjh-dbc3
Aliases CVE-2025-0242
Summary Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Firefox ESR < 115.19, Thunderbird < 134, and Thunderbird ESR < 128.6.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
System Score Found at
cvssv3 8.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-0242.json
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00096 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00168 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00202 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00202 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00202 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00202 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00202 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00202 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00202 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00202 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00202 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00202 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00202 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00202 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00202 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00202 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00202 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00202 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00202 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00202 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00202 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00202 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00202 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00202 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00202 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00202 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00202 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00215 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00227 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00253 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00253 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00253 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00253 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00253 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00253 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00253 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00253 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
epss 0.00253 https://api.first.org/data/v1/epss?cve=CVE-2025-0242
cvssv3.1 6.5 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1874523%2C1926454%2C1931873%2C1932169
ssvc Track https://bugzilla.mozilla.org/buglist.cgi?bug_id=1874523%2C1926454%2C1931873%2C1932169
cvssv3.1 6.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2025-01
generic_textual none https://www.mozilla.org/en-US/security/advisories/mfsa2025-02
generic_textual none https://www.mozilla.org/en-US/security/advisories/mfsa2025-03
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2025-04
generic_textual none https://www.mozilla.org/en-US/security/advisories/mfsa2025-05
cvssv3.1 6.5 https://www.mozilla.org/security/advisories/mfsa2025-01/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-01/
cvssv3.1 6.5 https://www.mozilla.org/security/advisories/mfsa2025-02/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-02/
cvssv3.1 6.5 https://www.mozilla.org/security/advisories/mfsa2025-03/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-03/
cvssv3.1 6.5 https://www.mozilla.org/security/advisories/mfsa2025-04/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-04/
cvssv3.1 6.5 https://www.mozilla.org/security/advisories/mfsa2025-05/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-05/
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-0242.json
https://api.first.org/data/v1/epss?cve=CVE-2025-0242
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1874523%2C1926454%2C1931873%2C1932169
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0242
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://www.mozilla.org/security/advisories/mfsa2025-01/
https://www.mozilla.org/security/advisories/mfsa2025-02/
https://www.mozilla.org/security/advisories/mfsa2025-03/
https://www.mozilla.org/security/advisories/mfsa2025-04/
https://www.mozilla.org/security/advisories/mfsa2025-05/
2336181 https://bugzilla.redhat.com/show_bug.cgi?id=2336181
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
CVE-2025-0242 https://nvd.nist.gov/vuln/detail/CVE-2025-0242
GLSA-202501-10 https://security.gentoo.org/glsa/202501-10
GLSA-202505-03 https://security.gentoo.org/glsa/202505-03
mfsa2025-01 https://www.mozilla.org/en-US/security/advisories/mfsa2025-01
mfsa2025-02 https://www.mozilla.org/en-US/security/advisories/mfsa2025-02
mfsa2025-03 https://www.mozilla.org/en-US/security/advisories/mfsa2025-03
mfsa2025-04 https://www.mozilla.org/en-US/security/advisories/mfsa2025-04
mfsa2025-05 https://www.mozilla.org/en-US/security/advisories/mfsa2025-05
RHSA-2025:0080 https://access.redhat.com/errata/RHSA-2025:0080
RHSA-2025:0132 https://access.redhat.com/errata/RHSA-2025:0132
RHSA-2025:0133 https://access.redhat.com/errata/RHSA-2025:0133
RHSA-2025:0134 https://access.redhat.com/errata/RHSA-2025:0134
RHSA-2025:0135 https://access.redhat.com/errata/RHSA-2025:0135
RHSA-2025:0136 https://access.redhat.com/errata/RHSA-2025:0136
RHSA-2025:0137 https://access.redhat.com/errata/RHSA-2025:0137
RHSA-2025:0138 https://access.redhat.com/errata/RHSA-2025:0138
RHSA-2025:0144 https://access.redhat.com/errata/RHSA-2025:0144
RHSA-2025:0147 https://access.redhat.com/errata/RHSA-2025:0147
RHSA-2025:0162 https://access.redhat.com/errata/RHSA-2025:0162
RHSA-2025:0165 https://access.redhat.com/errata/RHSA-2025:0165
RHSA-2025:0166 https://access.redhat.com/errata/RHSA-2025:0166
RHSA-2025:0167 https://access.redhat.com/errata/RHSA-2025:0167
RHSA-2025:0275 https://access.redhat.com/errata/RHSA-2025:0275
RHSA-2025:0281 https://access.redhat.com/errata/RHSA-2025:0281
RHSA-2025:0284 https://access.redhat.com/errata/RHSA-2025:0284
RHSA-2025:0286 https://access.redhat.com/errata/RHSA-2025:0286
RHSA-2025:0287 https://access.redhat.com/errata/RHSA-2025:0287
USN-7191-1 https://usn.ubuntu.com/7191-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-0242.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://bugzilla.mozilla.org/buglist.cgi?bug_id=1874523%2C1926454%2C1931873%2C1932169
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-01-08T16:40:52Z/ Found at https://bugzilla.mozilla.org/buglist.cgi?bug_id=1874523%2C1926454%2C1931873%2C1932169
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://www.mozilla.org/security/advisories/mfsa2025-01/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-01-08T16:40:52Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-01/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://www.mozilla.org/security/advisories/mfsa2025-02/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-01-08T16:40:52Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-02/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://www.mozilla.org/security/advisories/mfsa2025-03/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-01-08T16:40:52Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-03/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://www.mozilla.org/security/advisories/mfsa2025-04/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-01-08T16:40:52Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-04/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://www.mozilla.org/security/advisories/mfsa2025-05/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-01-08T16:40:52Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-05/
Exploit Prediction Scoring System (EPSS)
Percentile 0.12225
EPSS Score 0.00044
Published At Jan. 16, 2025, midnight
Date Actor Action Source VulnerableCode Version
2025-01-12T22:33:25.593857+00:00 NVD Importer Import https://nvd.nist.gov/vuln/detail/CVE-2025-0242 35.1.0