CVE-2025-1936CWE-158

CVE-2025-1936

High · published March 4, 2025

CVSS v3.1
7.3
EPSS
0%
Percentile
37.8
In the wild
Unconfirmed
What it is

jar: URLs retrieve local file content packaged in a ZIP archive. The null and everything after it was ignored when retrieving the content from the archive, but the fake extension after the null was used to determine the type of content. This could have been used to hide code in a web extension disguised as something else like an image. This vulnerability was fixed in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00447 · 37.8th percentile
Weakness
CWE-158 · Improper Neutralization of Null Byte or NUL Character
Published
2025-03-04T19:15Z
Affected products (4)
ProductVersionsFixed in
mozilla/firefox< 128.8.0128.8.0
mozilla/firefox< 136.0136.0
mozilla/thunderbird< 128.8.0128.8.0
mozilla/thunderbird≥ 129.0, < 136.0136.0
References (6)
https://bugzilla.mozilla.org/show_bug.cgi?id=1940027 · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-14/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-16/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-17/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-18/ · [email protected]https://lists.debian.org/debian-lts-announce/2025/03/msg00006.html · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 04 MAR 13:31Z
    Adding %00 and a fake extension to a jar: URL changed the interpretation of the contents
    cvelistv5