CVE-2025-1936 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

jar: URLs retrieve local file content packaged in a ZIP archive. The null and everything after it was ignored when retrieving the content from the archive, but…
High CVSS: 7.3

CVE-2025-1936

jar: URLs retrieve local file content packaged in a ZIP archive. The null and everything after it was ignored when retrieving the content from the archive, but the fake extension after the null was used to determine the type of content. This could have been used to hide code in a web extension disguised as something else like an image. This vulnerability affects Firefox < 136, Firefox ESR < 128.8, Thunderbird < 136, and Thunderbird < 128.8.
Vendor
Mozilla
Product
Firefox
CWE
CWE-158
Yayın Tarihi
2025-03-04 14:15:38
Güncelleme
2025-11-03 21:18:54
Source Identifier
security@mozilla.org
KEV Date Added
-

Kategoriler

CWE-158 Firefox HIGH Mozilla 2025

Referanslar

https://bugzilla.mozilla.org/show_bug.cgi?id=1940027 https://www.mozilla.org/security/advisories/mfsa2025-14/ https://www.mozilla.org/security/advisories/mfsa2025-16/ https://www.mozilla.org/security/advisories/mfsa2025-17/ https://www.mozilla.org/security/advisories/mfsa2025-18/ https://lists.debian.org/debian-lts-announce/2025/03/msg00006.html