firefox-140.6.0esr and spidermonkey (js)

[Joe Locash]

Release notes not available yet.

[zeckma]

Security fixes (High)

Total (10); High (5); Moderate (5)

• CVE-2025-14321 (High): Use-after-free in the WebRTC: Signaling component
• CVE-2025-14322 (High): Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component
• CVE-2025-14323 (High): Privilege escalation in the DOM: Notifications component
• CVE-2025-14324 (High): JIT miscompilation in the JavaScript Engine: JIT component
• CVE-2025-14325 (High): JIT miscompilation in the JavaScript Engine: JIT component
• CVE-2025-14328 (Moderate): Privilege escalation in the Netmonitor component
• CVE-2025-14329 (Moderate): Privilege escalation in the Netmonitor component
• CVE-2025-14330 (Moderate): JIT miscompilation in the JavaScript Engine: JIT component
• CVE-2025-14331 (Moderate): Same-origin policy bypass in the Request Handling component
• CVE-2025-14333 (Moderate): Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146

[zeckma]

Spidermonkey should be subject to: CVE-2025-14322, CVE-2025-14324, CVE-2025-14325, and CVE-2025-14330.

[zeckma]

Fixed at 52a308e3166b3fbacf5b709bf1e421c72ad2aa75. Leaving open for SA filing.

[zeckma]

SA-12.4-058 and SA-12.4-059 issued.

[Bruce Dubbs]

Milestone renamed