Search for vulnerabilities
Vulnerability details: VCID-kwpw-wry4-huah
Vulnerability ID VCID-kwpw-wry4-huah
Aliases CVE-2025-1936
Summary jar: URLs retrieve local file content packaged in a ZIP archive. The null and everything after it was ignored when retrieving the content from the archive, but the fake extension after the null was used to determine the type of content. This could have been used to hide code in a web extension disguised as something else like an image.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-754 Improper Check for Unusual or Exceptional Conditions
System Score Found at
cvssv3 5.4 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-1936.json
epss 0.0015 https://api.first.org/data/v1/epss?cve=CVE-2025-1936
epss 0.00167 https://api.first.org/data/v1/epss?cve=CVE-2025-1936
epss 0.00167 https://api.first.org/data/v1/epss?cve=CVE-2025-1936
epss 0.00167 https://api.first.org/data/v1/epss?cve=CVE-2025-1936
epss 0.00167 https://api.first.org/data/v1/epss?cve=CVE-2025-1936
epss 0.00167 https://api.first.org/data/v1/epss?cve=CVE-2025-1936
epss 0.00167 https://api.first.org/data/v1/epss?cve=CVE-2025-1936
epss 0.00167 https://api.first.org/data/v1/epss?cve=CVE-2025-1936
epss 0.00167 https://api.first.org/data/v1/epss?cve=CVE-2025-1936
epss 0.00167 https://api.first.org/data/v1/epss?cve=CVE-2025-1936
epss 0.00167 https://api.first.org/data/v1/epss?cve=CVE-2025-1936
epss 0.00167 https://api.first.org/data/v1/epss?cve=CVE-2025-1936
epss 0.00207 https://api.first.org/data/v1/epss?cve=CVE-2025-1936
epss 0.00219 https://api.first.org/data/v1/epss?cve=CVE-2025-1936
epss 0.00219 https://api.first.org/data/v1/epss?cve=CVE-2025-1936
epss 0.00219 https://api.first.org/data/v1/epss?cve=CVE-2025-1936
epss 0.00219 https://api.first.org/data/v1/epss?cve=CVE-2025-1936
epss 0.00219 https://api.first.org/data/v1/epss?cve=CVE-2025-1936
cvssv3.1 7.3 https://bugzilla.mozilla.org/show_bug.cgi?id=1940027
ssvc Track https://bugzilla.mozilla.org/show_bug.cgi?id=1940027
cvssv3.1 5.4 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2025-14
generic_textual critical https://www.mozilla.org/en-US/security/advisories/mfsa2025-16
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2025-17
generic_textual critical https://www.mozilla.org/en-US/security/advisories/mfsa2025-18
cvssv3.1 7.3 https://www.mozilla.org/security/advisories/mfsa2025-14/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-14/
cvssv3.1 7.3 https://www.mozilla.org/security/advisories/mfsa2025-16/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-16/
cvssv3.1 7.3 https://www.mozilla.org/security/advisories/mfsa2025-17/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-17/
cvssv3.1 7.3 https://www.mozilla.org/security/advisories/mfsa2025-18/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-18/
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-1936.json
https://api.first.org/data/v1/epss?cve=CVE-2025-1936
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1936
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
2349797 https://bugzilla.redhat.com/show_bug.cgi?id=2349797
cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
CVE-2025-1936 https://nvd.nist.gov/vuln/detail/CVE-2025-1936
mfsa2025-14 https://www.mozilla.org/en-US/security/advisories/mfsa2025-14
mfsa2025-14 https://www.mozilla.org/security/advisories/mfsa2025-14/
mfsa2025-16 https://www.mozilla.org/en-US/security/advisories/mfsa2025-16
mfsa2025-16 https://www.mozilla.org/security/advisories/mfsa2025-16/
mfsa2025-17 https://www.mozilla.org/en-US/security/advisories/mfsa2025-17
mfsa2025-17 https://www.mozilla.org/security/advisories/mfsa2025-17/
mfsa2025-18 https://www.mozilla.org/en-US/security/advisories/mfsa2025-18
mfsa2025-18 https://www.mozilla.org/security/advisories/mfsa2025-18/
RHSA-2025:2359 https://access.redhat.com/errata/RHSA-2025:2359
RHSA-2025:2452 https://access.redhat.com/errata/RHSA-2025:2452
RHSA-2025:2479 https://access.redhat.com/errata/RHSA-2025:2479
RHSA-2025:2480 https://access.redhat.com/errata/RHSA-2025:2480
RHSA-2025:2481 https://access.redhat.com/errata/RHSA-2025:2481
RHSA-2025:2484 https://access.redhat.com/errata/RHSA-2025:2484
RHSA-2025:2485 https://access.redhat.com/errata/RHSA-2025:2485
RHSA-2025:2486 https://access.redhat.com/errata/RHSA-2025:2486
RHSA-2025:2699 https://access.redhat.com/errata/RHSA-2025:2699
RHSA-2025:2708 https://access.redhat.com/errata/RHSA-2025:2708
show_bug.cgi?id=1940027 https://bugzilla.mozilla.org/show_bug.cgi?id=1940027
USN-7334-1 https://usn.ubuntu.com/7334-1/
USN-7663-1 https://usn.ubuntu.com/7663-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-1936.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://bugzilla.mozilla.org/show_bug.cgi?id=1940027
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-03-25T17:55:09Z/ Found at https://bugzilla.mozilla.org/show_bug.cgi?id=1940027
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://www.mozilla.org/security/advisories/mfsa2025-14/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-03-25T17:55:09Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-14/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://www.mozilla.org/security/advisories/mfsa2025-16/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-03-25T17:55:09Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-16/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://www.mozilla.org/security/advisories/mfsa2025-17/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-03-25T17:55:09Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-17/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://www.mozilla.org/security/advisories/mfsa2025-18/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-03-25T17:55:09Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-18/
Exploit Prediction Scoring System (EPSS)
Percentile 0.36349
EPSS Score 0.0015
Published At July 31, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:09:23.791783+00:00 Mozilla Importer Import https://github.com/mozilla/foundation-security-advisories/blob/master/announce/2025/mfsa2025-16.yml 37.0.0