PT-2025-9661 · Mozilla+11 · Firefox+11
Surya Dev Singh
·
Publicado
2025-03-04
·
Atualizado
2025-07-22
·
CVE-2025-1936
CVSS v3.1
7.3
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
Firefox versions prior to 136
Firefox ESR versions prior to 128.8
Description
The issue allows jar: URLs to retrieve local file content packaged in a ZIP archive. When retrieving content from the archive, anything after a null character is ignored, but a fake extension after the null can be used to determine the content type. This could be exploited to hide code in a web extension disguised as a different file type, such as an image.
Recommendations
For Firefox versions prior to 136, update to version 136 or later.
For Firefox ESR versions prior to 128.8, update to version 128.8 or later.
Correção
Improper Check for Exceptional Conditions
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Firefox
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu