Debian/firefox-esr: high 7.5

A race during concurrent delazification could have led to a use-after-free. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.

Action: Upgrade firefox-esr to 128.7.0esr-1~deb12u1 or later.

Affected

Fixed versions

Sources

• osv: DEBIAN-CVE-2025-1012
• https://security-tracker.debian.org/tracker/CVE-2025-1012

published 2025-02-04T14:15:32Z · modified 2026-10-06T09:47:25.189534190Z · JSON