firefox-140.2.0esr (and js)

[zeckma]

New minor version. Release notes are still being worked on, so I don't know if there are any security fixes. Since Firefox hasn't been tagged in BLFS yet, I'm putting this up as 12.4 for now.

[Bruce Dubbs]

Actually FF is not affected by package freeze. It is an 'end' package because nothing depends on it.

[zeckma]

Replying to Bruce Dubbs:

Actually FF is not affected by package freeze. It is an 'end' package because nothing depends on it.

Thanks for letting me know!

[Douglas R. Reno]

Replying to Bruce Dubbs:

Actually FF is not affected by package freeze. It is an 'end' package because nothing depends on it.

This I disagree with a little bit. We currently have Firefox tied directly into Spidermonkey, where changing the version for Firefox also means that Spidermonkey gets updated. That means that at least gjs has to get retested it again if it's already tagged.

Something like Thunderbird though is for sure an end package, but Firefox feels like a little bit of a gray area. Still safe to update for now though :)

[Xi Ruoyao]

Regarding Spidermonkey: the ln command for ProfilingCategoryList.h is no longer needed, but the sed for XP_UNIX is still needed.

[Douglas R. Reno]

• CVE-2025-9179: Sandbox escape due to invalid pointer in the Audio/Video: GMP component (High). Description: "An attacker was able to perform memory corruption in the GMP process which processes encrypted media. This process is also heavily sandboxed, but represents slightly different privileges from the content process."

• CVE-2025-9180: Same-origin policy bypass in the Graphics: Canvas2D component (High)

• CVE-2025-9181: Uninitialized memory in the JavaScript Engine component (Moderate)

• CVE-2025-9182: Denial-of-service due to out-of-memory in the Graphics: WebRender component (Low)

• CVE-2025-9183: Spoofing issue in the Address Bar component (Low)

• CVE-2025-9184: Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142 (High). Description: "Memory safety bugs present in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code."

• CVE-2025-9185: Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142 (High). Description: "Memory safety bugs present in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code."

[Douglas R. Reno]

I'm going to update the above comment now that CVEs are published

[Douglas R. Reno]

Fixed at c73dc9db5c508eff40fd59300b6ab3f1ea147822

SA-12.3-095 issued for Firefox, and 12.3-097 for SpiderMonkey.