CVE-2025-0239

EUVD-2025-1571
When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
mozillafirefox_esr
𝑥
< 128.6.0
mozillafirefox
𝑥
< 134.0
mozillathunderbird
𝑥
< 128.6.0
mozillathunderbird
129.0 ≤
𝑥
< 134.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
firefox
sid
149.0.2-1
fixed
firefox-esr
bookworm
128.14.0esr-1~deb12u1
fixed
bookworm (security)
140.9.1esr-1~deb12u1
fixed
bullseye
vulnerable
bullseye (security)
140.9.1esr-1~deb11u1
fixed
forky
140.9.1esr-1
fixed
sid
140.9.1esr-1
fixed
trixie
140.8.0esr-1~deb13u1
fixed
trixie (security)
140.9.1esr-1~deb13u1
fixed
thunderbird
bookworm
1:140.6.0esr-1~deb12u1
fixed
bookworm (security)
1:140.9.1esr-1~deb12u1
fixed
bullseye
vulnerable
bullseye (security)
1:140.9.1esr-1~deb11u1
fixed
forky
1:140.9.0esr-1
fixed
sid
1:140.9.1esr-1
fixed
trixie
1:140.8.0esr-1~deb13u1
fixed
trixie (security)
1:140.9.1esr-1~deb13u1
fixed
Common Weakness Enumeration
References
https://bugzilla.mozilla.org/show_bug.cgi?id=1929156
https://www.mozilla.org/security/advisories/mfsa2025-01/
https://www.mozilla.org/security/advisories/mfsa2025-02/
https://www.mozilla.org/security/advisories/mfsa2025-04/
https://www.mozilla.org/security/advisories/mfsa2025-05/
https://lists.debian.org/debian-lts-announce/2025/01/msg00004.html