Information disclosure in Firefox for Android and Mozilla Firefox - CVE-2025-1942

Vulnerability identifier: #VU105324

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-1942

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application within the String.toUpperCase() function, which includes parts of uninitialized memory into the result output. A remote attacker can gain unauthorized access to sensitive information.

Firefox for Android
Mozilla Firefox
Gentoo Linux
Ubuntu
Fedora
Mozilla Thunderbird
www-client/firefox
www-client/firefox-bin
firefox (Ubuntu package)
firefox
thunderbird (Ubuntu package)

Install updates from vendor's website.

Firefox for Android - update to 136.0
Mozilla Firefox - update to 136.0
Mozilla Thunderbird - update to 136.0
www-client/firefox - update to 60.8.0
www-client/firefox-bin - update to 60.8.0
firefox (Ubuntu package) - update to 136.0+build3-0ubuntu0.20.04.1
firefox - addressed in versions 136.0-2.fc40, 136.0-2.fc41, 136.0-2.fc42
thunderbird (Ubuntu package) - update to 1:140.7.1+build1-0ubuntu0.22.04.1

• https://www.mozilla.org/en-US/security/advisories/mfsa2025-14/
• https://bugzilla.mozilla.org/show_bug.cgi?id=1947139

• Multiple vulnerabilities in Mozilla Firefox
• Multiple vulnerabilities in Mozilla Thunderbird
• Fedora 41 update for firefox
• Fedora 42 update for firefox
• Fedora 40 update for firefox
• Ubuntu update for firefox
• Gentoo update for Mozilla Firefox
• Ubuntu update for thunderbird