Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.0
CVE-2025-0239: Firefox and Thunderbird may trust unsafe sites after redirect
CVE-2025-0239 · published 1 year ago
Summary
Firefox web browser and Thunderbird email client could fail to fully verify a site's security certificate when an alternate service redirects to a non‑secure site. This could let attackers intercept or tamper with data. Upgrade to the latest Firefox and Thunderbird releases to resolve the issue.
What to do
- Update canonical firefox to version 134.0+build1-0ubuntu0.20.04.1.
- Update canonical thunderbird to version 1:140.7.1+build1-0ubuntu0.22.04.1.
- Update debian firefox-esr to version 128.6.0esr-1~deb11u3.
- Update debian firefox-esr to version 128.6.0esr-1~deb12u1.
- Update debian firefox-esr to version 128.6.0esr-1.
- Update debian thunderbird to version 1:128.6.0esr-1~deb11u1.
- Update debian thunderbird to version 1:128.6.0esr-1~deb12u1.
- Update debian thunderbird to version 1:128.6.0esr-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | mozilla | firefox |
< 128.6.0 < 134.0 cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* |
| – | mozilla | thunderbird |
< 128.6.0 >= 129.0, < 134.0 cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* |
| Ubuntu:18.04:LTS | canonical | mozjs52 | All versions |
| Ubuntu:18.04:LTS | canonical | mozjs38 | All versions |
| Ubuntu:20.04:LTS | canonical | firefox |
< 134.0+build1-0ubuntu0.20.04.1 Fix: upgrade to 134.0+build1-0ubuntu0.20.04.1
|
| Ubuntu:20.04:LTS | canonical | mozjs68 | All versions |
| Ubuntu:20.04:LTS | canonical | mozjs52 | All versions |
| Ubuntu:22.04:LTS | canonical | mozjs102 | All versions |
| Ubuntu:22.04:LTS | canonical | mozjs78 | All versions |
| Ubuntu:22.04:LTS | canonical | mozjs91 | All versions |
| Ubuntu:22.04:LTS | canonical | thunderbird |
< 1:140.7.1+build1-0ubuntu0.22.04.1 Fix: upgrade to 1:140.7.1+build1-0ubuntu0.22.04.1
|
| Ubuntu:24.04:LTS | canonical | mozjs102 | All versions |
| Ubuntu:24.04:LTS | canonical | mozjs115 | All versions |
| Debian:11 | debian | firefox-esr |
< 128.6.0esr-1~deb11u3 Fix: upgrade to 128.6.0esr-1~deb11u3
|
| Debian:12 | debian | firefox-esr |
< 128.6.0esr-1~deb12u1 Fix: upgrade to 128.6.0esr-1~deb12u1
|
| Debian:13 | debian | firefox-esr |
< 128.6.0esr-1 Fix: upgrade to 128.6.0esr-1
|
| Debian:14 | debian | firefox-esr |
< 128.6.0esr-1 Fix: upgrade to 128.6.0esr-1
|
| Debian:11 | debian | thunderbird |
< 1:128.6.0esr-1~deb11u1 Fix: upgrade to 1:128.6.0esr-1~deb11u1
|
| Debian:12 | debian | thunderbird |
< 1:128.6.0esr-1~deb12u1 Fix: upgrade to 1:128.6.0esr-1~deb12u1
|
| Debian:13 | debian | thunderbird |
< 1:128.6.0esr-1 Fix: upgrade to 1:128.6.0esr-1
|
| Debian:14 | debian | thunderbird |
< 1:128.6.0esr-1 Fix: upgrade to 1:128.6.0esr-1
|
Original advisory text
When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderb...
When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.
References
- https://ubuntu.com/security/CVE-2025-0239 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-0239 Third Party Advisory
- https://www.mozilla.org/en-US/security/advisories/mfsa2025-01/#CVE-2025-0239 Third Party Advisory
- https://www.mozilla.org/en-US/security/advisories/mfsa2025-02/#CVE-2025-0239 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2025-0239 Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2025-04/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2025-05/ Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2025/01/msg00004.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=1929156 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2025-01/ Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2025-02/ Third Party Advisory
- https://ubuntu.com/security/notices/USN-7191-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-7991-1 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-295Improper Certificate Validation
Timeline
Published7 Jan 2025
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta