PT-2025-21811 · Mozilla+2 · Firefox+2

Published 2025-05-17 · Updated 2025-07-11 · CVE-2025-4921

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 138.0.4 Firefox ESR versions prior to 128.10.1

Description: An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes.

Recommendations: For Firefox versions prior to 138.0.4, update to version 138.0.4 or later. For Firefox ESR versions prior to 128.10.1, update to version 128.10.1 or later.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALT-PU-2025-8725

BDU:2025-06659

CVE-2025-4921

DSA-5922-1

OPENSUSE-SU-2025:15172-1

Affected Products

Alt Linux

Debian

Firefox

References · 21

• https://osv.dev/vulnerability/DSA-5922-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15172-1 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2025-36 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2025-36 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4921 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-4921 · Security Note
• https://bdu.fstec.ru/vul/2025-06659 · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2025-37 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2025-38 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2025-37 · Vendor Advisory
• https://xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.13 · Note
• https://suse.com/security/cve/CVE-2025-4921 · Note
• https://twitter.com/VulmonFeeds/status/1923872982432186801 · Twitter Post
• https://xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/3.1 · Note
• https://suse.com/security/cve/CVE-2025-4920 · Note