CVE-2025-9179

Name
CVE-2025-9179
Description
An attacker was able to perform memory corruption in the GMP process which processes encrypted media. This process is also heavily sandboxed, but represents slightly different privileges from the content process. This vulnerability affects Firefox < 142, Firefox ESR < 115.27, Firefox ESR < 128.14, Firefox ESR < 140.2, Thunderbird < 142, Thunderbird < 128.14, and Thunderbird < 140.2.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
security@mozilla.org https://bugzilla.mozilla.org/show_bug.cgi?id=1979527
security@mozilla.org https://www.mozilla.org/security/advisories/mfsa2025-64/
security@mozilla.org https://www.mozilla.org/security/advisories/mfsa2025-65/
security@mozilla.org https://www.mozilla.org/security/advisories/mfsa2025-66/
security@mozilla.org https://www.mozilla.org/security/advisories/mfsa2025-67/
security@mozilla.org https://www.mozilla.org/security/advisories/mfsa2025-70/
security@mozilla.org https://www.mozilla.org/security/advisories/mfsa2025-71/
security@mozilla.org https://www.mozilla.org/security/advisories/mfsa2025-72/
af854a3a-2127-422b-91ae-364da2661108 https://lists.debian.org/debian-lts-announce/2025/08/msg00016.html
af854a3a-2127-422b-91ae-364da2661108 https://lists.debian.org/debian-lts-announce/2025/08/msg00018.html

Match rules

CPE URI Source package Min version Max version
firefox-esr >= unspecified < 115.27
firefox-esr >= unspecified < 128.14
firefox-esr >= unspecified < 140.2
thunderbird >= unspecified < 128.14
thunderbird >= unspecified < 140.2
firefox >= unspecified < 142
thunderbird >= unspecified < 142

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
firefox edge-community 141.0-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox edge-community 140.0.4-r1 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox edge-community 140.0.4-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox edge-community 140.0.2-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
thunderbird edge-community 140.0.1-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
thunderbird edge-community 140.0-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox edge-community 139.0.4-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
thunderbird edge-community 139.0.2-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox edge-community 139.0-r1 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox edge-community 139.0-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox edge-community 138.0.4-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox edge-community 138.0.3-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox edge-community 138.0.1-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
thunderbird edge-community 138.0-r2 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
thunderbird edge-community 138.0-r1 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox edge-community 138.0-r1 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
thunderbird edge-community 138.0-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox edge-community 138.0-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
thunderbird edge-community 137.0.1-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox edge-community 137.0.1-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
thunderbird edge-community 137.0-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox edge-community 136.0.4-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox edge-community 136.0.3-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox edge-community 136.0.2-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox edge-community 136.0-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox edge-community 135.0.1-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox edge-community 135.0-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox edge-community 134.0.1-r1 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox edge-community 134.0.1-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox edge-community 134.0-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox edge-community 133.0-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox-esr edge-community 128.9.0-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox-esr edge-community 128.8.1-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox-esr edge-community 128.8.0-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
thunderbird edge-community 128.8.0-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
thunderbird edge-community 128.7.1-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox-esr edge-community 128.7.0-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
thunderbird edge-community 128.7.0-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox-esr edge-community 128.6.0-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
thunderbird edge-community 128.6.0-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
thunderbird edge-community 128.5.2-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox-esr edge-community 128.5.1-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
thunderbird edge-community 128.5.1-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox-esr edge-community 128.13.0-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox-esr edge-community 128.11.0-r2 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox-esr edge-community 128.11.0-r1 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox-esr edge-community 128.11.0-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox-esr edge-community 128.10.1-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox-esr edge-community 128.10.0-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox 3.22-community 140.0.4-r1 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
thunderbird 3.22-community 140.0.1-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox 3.22-community 136.0.4-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox-esr 3.22-community 128.14.0-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
thunderbird 3.22-community 128.11.0-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox-esr 3.22-community 128.11.0-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable
firefox-esr 3.22-community 128.10.1-r0 Patrycja Rosa <alpine@ptrcnull.me> possibly vulnerable