CVE-2025-1936

Katalog CVE

CVSS 7.3 · High EPSS 0,45%

Kerentanan Improper Neutralization of Null Byte or NUL Character pada mozilla firefox, mozilla thunderbird. Skor CVSS 3.1 7.3 (High) menurut CISA ADP.

Deskripsi (NVD)

jar: URLs retrieve local file content packaged in a ZIP archive. The null and everything after it was ignored when retrieving the content from the archive, but the fake extension after the null was used to determine the type of content. This could have been used to hide code in a web extension disguised as something else like an image. This vulnerability was fixed in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.

Rincian

Terbit di NVD

4 Maret 2025

Terakhir diubah

5 Oktober 2026

Status NVD

Modified

CVSS 3.1

7.3 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-158: Improper Neutralization of Null Byte or NUL Character

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 37,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.mozilla.org/security/advisories/mfsa2025-14/ advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2025-16/ advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2025-17/ advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2025-18/ advisory vendor
• https://bugzilla.mozilla.org/show_bug.cgi?id=1940027 permissions required
• https://lists.debian.org/debian-lts-announce/2025/03/msg00006.html