CVE-2025-1014
published 2025-02-04CVE-2025-1014: Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed. This vulnerability was fixed in…
PriorityP340high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.39%
32.9th percentile
Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | < firefox 135.0-1 (sid) | firefox 135.0-1 (sid) |
| debian | firefox-esr | < firefox 135.0-1 (sid) | firefox 135.0-1 (sid) |
| debian | thunderbird | < firefox 135.0-1 (sid) | firefox 135.0-1 (sid) |
| linux | linux_kernel | >= 4.12.0 < 5.10.248 | 5.10.248 |
| linux | linux_kernel | >= 5.11.0 < 5.15.198 | 5.15.198 |
| linux | linux_kernel | >= 5.16.0 < 6.1.160 | 6.1.160 |
| linux | linux_kernel | >= 6.13.0 < 6.17.13 | 6.17.13 |
| linux | linux_kernel | >= 6.18.0 < 6.18.2 | 6.18.2 |
| linux | linux_kernel | >= 6.2.0 < 6.6.120 | 6.6.120 |
| linux | linux_kernel | >= 6.7.0 < 6.12.63 | 6.12.63 |
| mozilla | firefox | < 128.7.0 | 128.7.0 |
| mozilla | firefox | < 135.0 | 135.0 |
| mozilla | firefox | — | — |
| mozilla | firefox | >= 0 < 135.0+build2-0ubuntu0.20.04.1 | 135.0+build2-0ubuntu0.20.04.1 |
| mozilla | thunderbird | >= 0 < 1:128.7.0esr-1~deb11u1 | 1:128.7.0esr-1~deb11u1 |
| mozilla | thunderbird | >= 0 < 1:128.7.0esr-1~deb12u1 | 1:128.7.0esr-1~deb12u1 |
| mozilla | thunderbird | >= 0 < 1:128.7.0esr-1 | 1:128.7.0esr-1 |
| mozilla | thunderbird | >= 0 < 1:128.7.0esr-1 | 1:128.7.0esr-1 |
| mozilla | thunderbird | >= 128.0.1 < 128.7.0 | 128.7.0 |
| mozilla | thunderbird | >= 131.0 < 135.0 | 135.0 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vendor_ubuntu9.8CRITICAL
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: nbd: defer config unlock in nbd_genl_connect
vendor_redhat·2025-12-24·CVSS 5.5
CVE-2025-68366 [LOW] kernel: nbd: defer config unlock in nbd_genl_connect
kernel: nbd: defer config unlock in nbd_genl_connect
In the Linux kernel, the following vulnerability has been resolved:
nbd: defer config unlock in nbd_genl_connect
There is one use-after-free warning when running NBD_CMD_CONNECT and
NBD_CLEAR_SOCK:
nbd_genl_connect
nbd_alloc_and_init_config // config_refs=1
nbd_start_device // config_refs=2
set NBD_RT_HAS_CONFIG_REFopen nbd // config_refs=3
recv_work done // config_refs=2
NBD_CLEAR_SOCK // config_refs=1
close nbd // config_refs=0
refcount_inc -> uaf
------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 24 PID: 1014 at lib/refcount.c:25 refcount_warn_saturate+0x12e/0x290
nbd_genl_connect+0x16d0/0x1ab0
genl_family_rcv_msg_doit+0x1f3/0x310
genl_rcv_msg+0x44a/0x790
The issue can be easily reproduced b
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2025-07-22
CVE-2025-4083 Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Several security issues were fixed in Thunderbird.
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, bypass security restrictions, cross-site
tracing, or execute arbitrary code.
Instructions: This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart thunderbird to
make all the necessary changes.
Red Hat
kernel: f2fs: fix to do sanity check on sbi->total_valid_block_count
vendor_redhat·2025-07-03·CVSS 5.5
CVE-2025-38163 [MEDIUM] kernel: f2fs: fix to do sanity check on sbi->total_valid_block_count
kernel: f2fs: fix to do sanity check on sbi->total_valid_block_count
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to do sanity check on sbi->total_valid_block_count
syzbot reported a f2fs bug as below:
------------[ cut here ]------------
kernel BUG at fs/f2fs/f2fs.h:2521!
RIP: 0010:dec_valid_block_count+0x3b2/0x3c0 fs/f2fs/f2fs.h:2521
Call Trace:
f2fs_truncate_data_blocks_range+0xc8c/0x11a0 fs/f2fs/file.c:695
truncate_dnode+0x417/0x740 fs/f2fs/node.c:973
truncate_nodes+0x3ec/0xf50 fs/f2fs/node.c:1014
f2fs_truncate_inode_blocks+0x8e3/0x1370 fs/f2fs/node.c:1197
f2fs_do_truncate_blocks+0x840/0x12b0 fs/f2fs/file.c:810
f2fs_truncate_blocks+0x10d/0x300 fs/f2fs/file.c:838
f2fs_truncate+0x417/0x720 fs/f2fs/file.c:888
f2fs_setattr+0xc4f/0x12f0 fs/f2fs/file.c:1112
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2025-02-11·CVSS 9.8
CVE-2025-1016 [CRITICAL] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Several security issues were fixed in Firefox.
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across domains, or execute arbitrary code. (CVE-2025-1011,
CVE-2025-1013, CVE-2025-1014, CVE-2025-1016, CVE-2025-1017, CVE-2025-1018,
CVE-2025-1019, CVE-2025-1020)
Ivan Fratric discovered that Firefox did not properly handle XSLT data,
leading to a use-after-free vulnerability. An attacker could potentially
exploit this issue to cause a denial of service, or execute arbitrary code.
(CVE-2025-1009)
Atte Kettunen discovered that Firefox did not properly manage memory in
the Custom High
Red Hat
firefox: thunderbird: Certificate length was not properly checked
vendor_redhat·2025-02-04·CVSS 8.8
CVE-2025-1014 [HIGH] CWE-1284 firefox: thunderbird: Certificate length was not properly checked
firefox: thunderbird: Certificate length was not properly checked
Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed.
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.
Package: firefox (Red Hat Enterprise Linux 10) - Affected
Package: firefox-flatpak-container (Red Hat Enterprise Linux 10) - Affected
Package:
Debian
CVE-2025-1014: firefox - Certificate length was not properly checked when added to a certificate store. I...
vendor_debian·2025·CVSS 8.8
CVE-2025-1014 [HIGH] CVE-2025-1014: firefox - Certificate length was not properly checked when added to a certificate store. I...
Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.
Scope: local
sid: resolved (fixed in 135.0-1)
Mozilla
Mozilla Foundation Security Advisory 2025-11: CVE-2025-1014
vendor_mozilla·CVSS 8.8
CVE-2025-1014 [HIGH] Mozilla Foundation Security Advisory 2025-11: CVE-2025-1014
Mozilla Foundation Security Advisory 2025-11
CVE: CVE-2025-1014
Product: Thunderbird
Impact: high
Fixed in: Thunderbird 135
Mozilla
Mozilla Foundation Security Advisory 2025-09: CVE-2025-1014
vendor_mozilla·CVSS 8.8
CVE-2025-1014 [HIGH] Mozilla Foundation Security Advisory 2025-09: CVE-2025-1014
Mozilla Foundation Security Advisory 2025-09
CVE: CVE-2025-1014
Product: Firefox ESR
Impact: moderate
Fixed in: Firefox ESR 128.7
Mozilla
Mozilla Foundation Security Advisory 2025-07: CVE-2025-1014
vendor_mozilla·CVSS 8.8
CVE-2025-1014 [HIGH] Mozilla Foundation Security Advisory 2025-07: CVE-2025-1014
Mozilla Foundation Security Advisory 2025-07
CVE: CVE-2025-1014
Product: Firefox
Impact: high
Fixed in: Firefox 135
Mozilla
Mozilla Foundation Security Advisory 2025-10: CVE-2025-1014
vendor_mozilla·CVSS 8.8
CVE-2025-1014 [HIGH] Mozilla Foundation Security Advisory 2025-10: CVE-2025-1014
Mozilla Foundation Security Advisory 2025-10
CVE: CVE-2025-1014
Product: Thunderbird
Impact: moderate
Fixed in: Thunderbird 128.7
VulDB
Mozilla Firefox up to 128.6 Certificate Store certificate validation (Nessus ID 215021)
vuldb·2026-09-30·CVSS 8.8
CVE-2025-1014 [HIGH] Mozilla Firefox up to 128.6 Certificate Store certificate validation (Nessus ID 215021)
A vulnerability categorized as critical has been discovered in Mozilla Firefox up to 128.6. This affects an unknown function of the component Certificate Store. Executing a manipulation can lead to improper certificate validation.
This vulnerability is registered as CVE-2025-1014. The attack requires access to the local network. No exploit is available.
It is advisable to upgrade the affected component.
VulDB
Mozilla Thunderbird up to 128.6 Certificate Store certificate validation (Nessus ID 215021)
vuldb·2026-09-30·CVSS 8.8
CVE-2025-1014 [HIGH] Mozilla Thunderbird up to 128.6 Certificate Store certificate validation (Nessus ID 215021)
A vulnerability identified as critical has been detected in Mozilla Thunderbird up to 128.6. This impacts an unknown function of the component Certificate Store. The manipulation leads to improper certificate validation.
This vulnerability is documented as CVE-2025-1014. The attack requires being on the local network. There is not any exploit available.
You should upgrade the affected component.
OSV
nbd: defer config unlock in nbd_genl_connect
osv·2025-12-24
CVE-2025-68366 nbd: defer config unlock in nbd_genl_connect
nbd: defer config unlock in nbd_genl_connect
In the Linux kernel, the following vulnerability has been resolved:
nbd: defer config unlock in nbd_genl_connect
There is one use-after-free warning when running NBD_CMD_CONNECT and
NBD_CLEAR_SOCK:
nbd_genl_connect
nbd_alloc_and_init_config // config_refs=1
nbd_start_device // config_refs=2
set NBD_RT_HAS_CONFIG_REF open nbd // config_refs=3
recv_work done // config_refs=2
NBD_CLEAR_SOCK // config_refs=1
close nbd // config_refs=0
refcount_inc -> uaf
------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 24 PID: 1014 at lib/refcount.c:25 refcount_warn_saturate+0x12e/0x290
nbd_genl_connect+0x16d0/0x1ab0
genl_family_rcv_msg_doit+0x1f3/0x310
genl_rcv_msg+0x44a/0x790
The issue can be easily reproduced by
OSV
firefox vulnerabilities
osv·2025-02-11·CVSS 9.8
CVE-2025-1011 [CRITICAL] firefox vulnerabilities
firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across domains, or execute arbitrary code. (CVE-2025-1011,
CVE-2025-1013, CVE-2025-1014, CVE-2025-1016, CVE-2025-1017, CVE-2025-1018,
CVE-2025-1019, CVE-2025-1020)
Ivan Fratric discovered that Firefox did not properly handle XSLT data,
leading to a use-after-free vulnerability. An attacker could potentially
exploit this issue to cause a denial of service, or execute arbitrary code.
(CVE-2025-1009)
Atte Kettunen discovered that Firefox did not properly manage memory in
the Custom Highlight API, leading to a use-after-free vulnerability. An
attacke
GHSA
GHSA-v2xc-3r7v-9vrm: Certificate length was not properly checked when added to a certificate store
ghsa_unreviewed·2025-02-04
CVE-2025-1014 [HIGH] CWE-295 GHSA-v2xc-3r7v-9vrm: Certificate length was not properly checked when added to a certificate store
Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.
OSV
CVE-2025-1014: Certificate length was not properly checked when added to a certificate store
osv·2025-02-04·CVSS 8.8
CVE-2025-1014 [HIGH] CVE-2025-1014: Certificate length was not properly checked when added to a certificate store
Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-68366 kernel: nbd: defer config unlock in nbd_genl_connect
bugzilla·2025-12-24
CVE-2025-68366 [MEDIUM] CVE-2025-68366 kernel: nbd: defer config unlock in nbd_genl_connect
CVE-2025-68366 kernel: nbd: defer config unlock in nbd_genl_connect
In the Linux kernel, the following vulnerability has been resolved:
nbd: defer config unlock in nbd_genl_connect
There is one use-after-free warning when running NBD_CMD_CONNECT and
NBD_CLEAR_SOCK:
nbd_genl_connect
nbd_alloc_and_init_config // config_refs=1
nbd_start_device // config_refs=2
set NBD_RT_HAS_CONFIG_REF open nbd // config_refs=3
recv_work done // config_refs=2
NBD_CLEAR_SOCK // config_refs=1
close nbd // config_refs=0
refcount_inc -> uaf
------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 24 PID: 1014 at lib/refcount.c:25 refcount_warn_saturate+0x12e/0x290
nbd_genl_connect+0x16d0/0x1ab0
genl_family_rcv_msg_doit+0x1f3/0x310
genl_rcv_msg+0x44a/0x790
The issue can b
Bugzilla
CVE-2025-38163 kernel: f2fs: fix to do sanity check on sbi->total_valid_block_count
bugzilla·2025-07-03·CVSS 5.5
CVE-2025-38163 [MEDIUM] CVE-2025-38163 kernel: f2fs: fix to do sanity check on sbi->total_valid_block_count
CVE-2025-38163 kernel: f2fs: fix to do sanity check on sbi->total_valid_block_count
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to do sanity check on sbi->total_valid_block_count
syzbot reported a f2fs bug as below:
------------[ cut here ]------------
kernel BUG at fs/f2fs/f2fs.h:2521!
RIP: 0010:dec_valid_block_count+0x3b2/0x3c0 fs/f2fs/f2fs.h:2521
Call Trace:
f2fs_truncate_data_blocks_range+0xc8c/0x11a0 fs/f2fs/file.c:695
truncate_dnode+0x417/0x740 fs/f2fs/node.c:973
truncate_nodes+0x3ec/0xf50 fs/f2fs/node.c:1014
f2fs_truncate_inode_blocks+0x8e3/0x1370 fs/f2fs/node.c:1197
f2fs_do_truncate_blocks+0x840/0x12b0 fs/f2fs/file.c:810
f2fs_truncate_blocks+0x10d/0x300 fs/f2fs/file.c:838
f2fs_truncate+0x417/0x720 fs/f2fs/file.c:888
f2fs_setattr+0xc4f/0x12f0 fs
https://bugzilla.mozilla.org/show_bug.cgi?id=1940804https://www.mozilla.org/security/advisories/mfsa2025-07/https://www.mozilla.org/security/advisories/mfsa2025-09/https://www.mozilla.org/security/advisories/mfsa2025-10/https://www.mozilla.org/security/advisories/mfsa2025-11/https://lists.debian.org/debian-lts-announce/2025/02/msg00006.html
2025-02-04
Published