firefox-140.3.0esr + spidermonkey-140.3.0esr

[zeckma]

New minor version. Release notes are still being prepared.

[zeckma]

Issue mentioned in #22011 has not been resolved in this version. Until a fix comes out, I cannot complete this ticket, but will keep it assigned to myself.

[Joe Locash]

I wouldn't recommend waiting on updating a Firefox ESR release. They always have security fixes.

[zeckma]

Okay, so I found out a few things that weren't entirely clear to me at first:

1. Firefox as is, at least when FFmpeg was upgraded from 7.x to 8.0 (I don't know if FF builds on a fresh system with only FFmpeg 8.0 and had no previous version installed) does actually build successfully.
2. If Firefox was not edited, certain media fails to play after a rebuild/upgrade.
3. The fix for the above is not complete and in its current state causes Firefox to FTBFS.
4. Mozilla has not progressed the bug for the issue.

A wide fix would be to rollback FFmpeg to 7.x but is a last resort. We can bear it for now and wait it out. Either way, Firefox must be updated. A rebuild will cause certain media to not played. So for users to ensure reliability, they should not rebuild until the issue is resolved.

Testers, do not use the fix listed in #22011 if you want a successful build.

I will take care of this update now.

[zeckma]

I guess to add to this, I installed 140.3.0esr and tried playing various videos (YouTube), streams (Twitch), and movies (Google Play + troublesome movies) in Firefox. All of them worked. This is without any modifications. So at the very least, I don't have anything to worry about but this may not reflect other user's experiences.

[zeckma]

Vulnerabilities (High)

Firefox

• CVE-2025-10527 (High): Sandbox escape due to use-after-free in the Graphics: Canvas2D component
• CVE-2025-10528 (High): Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component
• CVE-2025-10537 (High): Memory safety bugs
• CVE-2025-10529 (Moderate): Same-origin policy bypass in the Layout component
• CVE-2025-10532 (Moderate): Incorrect boundary conditions in the JavaScript: GC component
• CVE-2025-10533 (Moderate): Integer overflow in the SVG component
• CVE-2025-10536 (Low): Information disclosure in the Networking: Cache component

Spidermonkey

• CVE-2025-10532 (Moderate): Incorrect boundary conditions in the JavaScript: GC component

[zeckma]

No other features or bugfixes were added in this release.

[zeckma]

Fixed at 80b610c1196a9b59c12ad64269c08a5e89d27be4. Leaving open for SAs to be issued.

[zeckma]

Replying to zeckma:

I guess to add to this, I installed 140.3.0esr and tried playing various videos (YouTube), streams (Twitch), and movies (Google Play + troublesome movies) in Firefox. All of them worked. This is without any modifications. So at the very least, I don't have anything to worry about but this may not reflect other user's experiences.

I rebooted and this changed to the opposite of each circumstance. Live streams no longer work (on YouTube) and some Google Play movies don't work.

[zeckma]

1. SA 12.4 001 issued for Firefox.
2. SA 12.4 002 issued for SpiderMonkey.

[Bruce Dubbs]

Milestone renamed