Critical · published February 4, 2025
🚨 A crafty bit of XSLT data can turn a perfectly safe browser into a crash-prone chaos machine! 🔥 Think of it as a recipe book where a single missing instruction causes the whole meal to flop — once the pot is boiling over, everything is ruined! An attacker could exploit this flaw to induce crashes in Firefox or Thunderbird, potentially leading to data loss or even system crashes. This could leave your sensitive information exposed, and we wouldn't want that, would we?
Think of it as a recipe book where a single missing instruction causes the whole meal to flop — once the pot is boiling over, everything is ruined! This use-after-free vulnerability allows attackers to manipulate memory in Firefox and Thunderbird via specially crafted XSLT data, which can lead to unexpected behavior and crashes.
An attacker could exploit this flaw to induce crashes in Firefox or Thunderbird, potentially leading to data loss or even system crashes. This could leave your sensitive information exposed, and we wouldn't want that, would we? Update to Firefox version 135, ESR versions 115.20, 128.7, and Thunderbird versions 128.7 or 135 immediately to patch this issue. Regularly check for updates to ensure your software is secure! You've got this! Stay vigilant and keep your browser safe with a quick update! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| mozilla/firefox | < 115.20.0 | 115.20.0 |
| mozilla/firefox | < 135.0 | 135.0 |
| mozilla/firefox | ≥ 128.1.0, < 128.7.0 | 128.7.0 |
| mozilla/thunderbird | ≥ 128.0.1, < 128.7.0 | 128.7.0 |
| mozilla/thunderbird | ≥ 131.0, < 135.0 | 135.0 |