<div class="container">
<h1>Security update for MozillaFirefox, MozillaFirefox-branding-SLE</h1>
<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-SU-2025:02339-1</td>
</tr>
<tr>
<th>Release Date:</th>
<td>2025-07-17T08:52:32Z</td>
</tr>
<tr>
<th>Rating:</th>
<td>important</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1244670">bsc#1244670</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>
Cross-References:
</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-6424.html">CVE-2025-6424</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-6425.html">CVE-2025-6425</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-6426.html">CVE-2025-6426</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-6427.html">CVE-2025-6427</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-6428.html">CVE-2025-6428</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-6429.html">CVE-2025-6429</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-6430.html">CVE-2025-6430</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-6431.html">CVE-2025-6431</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-6432.html">CVE-2025-6432</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-6433.html">CVE-2025-6433</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-6434.html">CVE-2025-6434</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-6435.html">CVE-2025-6435</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-6436.html">CVE-2025-6436</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>CVSS scores:</th>
<td>
<ul class="list-group">
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6424</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.7</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6424</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.8</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6424</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">9.8</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6425</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6425</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.4</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6425</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">4.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6426</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6426</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.2</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6426</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">8.8</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6427</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6427</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6427</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">9.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6428</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.1</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6428</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.0</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6428</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">4.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6429</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6429</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">4.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6429</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6430</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6430</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6430</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6431</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">2.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6431</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.8</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6431</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6432</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">2.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6432</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">4.2</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6432</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">8.6</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6433</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6433</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.4</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6433</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">9.8</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6434</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.1</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6434</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.4</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6434</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">4.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6435</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6435</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6435</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">8.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6436</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.7</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6436</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.8</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-6436</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">8.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H</span>
</li>
</ul>
</td>
</tr>
<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">
<li class="list-group-item">SUSE Linux Enterprise High Performance Computing 12 SP5</li>
<li class="list-group-item">SUSE Linux Enterprise Server 12 SP5</li>
<li class="list-group-item">SUSE Linux Enterprise Server 12 SP5 LTSS</li>
<li class="list-group-item">SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 12 SP5</li>
</ul>
</td>
</tr>
</tbody>
</table>
<p>An update that solves 13 vulnerabilities can now be installed.</p>
<h2>Description:</h2>
<p>This update for MozillaFirefox, MozillaFirefox-branding-SLE fixes the following issues:</p>
<p>This is the Firefox Extended Support Release 140.0esr ESR</p>
<p>Major changes:</p>
<p>General:</p>
<ul>
<li>Reader View now has an enhanced Text and Layout menu with
new options for character spacing, word spacing, and text
alignment. These changes offer a more accessible reading
experience.</li>
<li>Reader View now has a Theme menu with additional Contrast
and Gray options. You can also select custom colors for text,
background, and links from the Custom tab.</li>
<li>Firefox will now offer to temporarily remember when users
grant permissions to sites (e.g. geolocation). Temporary
permissions will be removed either after one hour or when the
tab is closed.</li>
<li>Firefox now includes safeguards to prevent sites from
abusing the history API by generating excessive history
entries, which can make navigating with the back and forward
buttons difficult by cluttering the history. This
intervention ensures that such entries, unless interacted
with by the user, are skipped when using the back and forward
buttons.</li>
<li>Firefox now identifies all links in PDFs and turns them
into hyperlinks.</li>
<li>You can now copy links from background tabs using the
tabstrip context menu on macOS and Linux.</li>
<li>Users on macOS and Linux are now given the option to close
only the current tab if the Quit keyboard shortcut is used
while multiple tabs are open in the window. (bmo#None)</li>
</ul>
<p>Sidebar and Tabs:</p>
<ul>
<li>You can now enable the updated Firefox sidebar in Settings
> General > Browser Layout to quickly access multiple tools
in one click, without leaving your main view. Sidebar tools
include an AI chatbot of your choice, bookmarks, history, and
tabs from devices you sync with your Mozilla account.</li>
<li>Keep a lot of tabs open? Try our new vertical tabs layout
to quickly scan your list of tabs. With vertical tabs, your
open and pinned tabs appear in the sidebar instead of along
the top of the browser. To turn on vertical tabs, right-click
on the toolbar near the top of the browser and select Turn on
Vertical Tabs. If you’ve enabled the updated sidebar, you can
also go to Customize sidebar and check Vertical tabs. Early
testers report feeling more organized after using vertical
tabs for a few days.</li>
<li>Stay productive and organized with less effort by grouping
related tabs together. One simple way to create a group is to
drag a tab onto another, pause until you see a highlight,
then drop to create the group. Tab groups can be named,
color-coded, and are always saved. You can close a group and
reopen it later.</li>
<li>A tab preview is now displayed when hovering the mouse over
background tabs, making it easier to locate the desired tab
without needing to switch tabs.</li>
<li>The sidebar to view tabs from other devices can now be
opened via the Tab overview menu.</li>
</ul>
<p>Security & Privacy:</p>
<ul>
<li>HTTPS is replacing HTTP as the default protocol in the
address bar on non-local sites. If a site is not available
via HTTPS, Firefox will fall back to HTTP.</li>
<li>Firefox now blocks third-party cookie access when Enhanced
Tracking Protection's Strict mode is enabled.</li>
<li>Firefox now has a new anti-tracking feature, Bounce
Tracking Protection, which is now available in Enhanced
Tracking Protection's "Strict" mode. This feature detects
bounce trackers based on their redirect behavior and
periodically purges their cookies and site data to block
tracking.</li>
<li>Firefox now enforces certificate transparency, requiring
web servers to provide sufficient proof that their
certificates were publicly disclosed before they will be
trusted. This only affects servers using certificates issued
by a certificate authority in Mozilla's Root CA Program.</li>
<li>Smartblock Embeds allows users to selectively unblock
certain social media embeds that are blocked in ETP Strict
and Private Browsing modes. Currently, support is limited to
a few embed types, with more to be added in future updates.</li>
<li>Firefox now upgrades page loads to HTTPS by default and
gracefully falls back to HTTP if the secure connection fails.
This behavior is known as HTTPS-First.</li>
<li>The "Copy Without Site Tracking" menu item was renamed to
"Copy Clean Link" to help clarify expectations around what
the feature does. "Copy Clean Link" is a list based approach
to remove - known tracking parameters from links. This option
can also now be used on plain text links.</li>
<li>The Clear browsing data and cookies dialog now allows
clearing saved form info separately from browsing history.</li>
</ul>
<p>Translations:</p>
<ul>
<li>Firefox now allows translating selected text portions to
different languages after a full-page translation.</li>
<li>Full-Page Translations are now available within Firefox
extension pages that start with the moz-extension:// URL
scheme.</li>
<li>When suggesting a default translation language, Firefox
will now take into consideration languages you have
previously used for translations.</li>
<li>Added support for many new languages in Firefox
translation.</li>
</ul>
<p>Windows:</p>
<ul>
<li>Canvas2D switched from Direct2D to a platform independent
acceleration backend on Windows.</li>
<li>Hardware-accelerated playback of HEVC video content is now
supported on Windows.</li>
<li>Firefox on Windows 11 now uses acrylic-style menus for
popup windows, which better match the operating system’s
aesthetic. (bmo#None)</li>
</ul>
<p>Linux:</p>
<ul>
<li>
<p>Firefox now supports touchpad hold gestures on Linux. This
means that kinetic (momentum) scrolling can now be
interrupted by placing two fingers on the touchpad.
(bmo#None)</p>
</li>
<li>
<p>Developer:</p>
</li>
<li>
<p>Firefox now supports text fragments, which
allows users to link directly to a specific portion of text
in a web document via a special URL fragment.</p>
</li>
<li>Debugger log-point values are now automatically converted
into profiler markers, making it easy to add information to
the marker timeline directly from the Debugger.</li>
<li>The Debugger's directory root is now scoped to the specific
domain where it was set, which aligns with typical usage and
avoids applying it across unrelated domains. This builds on
previous improvements such as a redesigned UI and easier
removal of the root setting. Setting a directory root updates
the Source List to show only the selected directory and its
children. (Learn more)</li>
<li>The Network Blocking feature in the Network panel now
blocks HTTP requests in addition to blocking responses.<ul>
<li>The Network panel displays information about Early Hints,
including a dedicated indicator for the 103 HTTP status code
in the user interface.</li>
</ul>
</li>
<li>The Network panel now allows overriding network request
responses with local files.</li>
<li>The filter setting in the Network panel is now preserved
across DevTools Toolbox sessions.</li>
<li>A new column has been added to the Network panel to display
the full path of the request URL. This enhancement makes
helps developers quickly view and analyze complete request
paths.</li>
<li>Introduced a new console command <code>$$$</code> that allows
searching the page, including within shadow roots.</li>
<li>Improved support for debugging web extensions, such as
automatically reloading the web extension's source code in
the Debugger when the extension is reloaded. Workers are now
available in the Console panel’s context selector and
breakpoints function correctly in content scripts.</li>
<li>In the Inspector Fonts panel, we now display fonts
metadata, like the font version, designer, vendor, license,
etc.</li>
<li>Added support for the import map integrity field, allowing
you to ensure the integrity of dynamically or statically
imported modules.</li>
<li>Implemented support for <code>Error.isError</code>, enabling brand
checks to determine whether an object is an instance of
Error. (Learn more)</li>
<li>
<p>Added support for the <code>error.captureStackTrace</code> extension
to improve compatibility with other browsers. (Learn more)
[5]: http://github.com/tc39/proposal-error-
capturestacktrace (bmo#None)</p>
</li>
<li>
<p>Enterprise:</p>
</li>
<li>
<p>The UserMessaging policy has been updated with
a new option to allow disabling Firefox Labs in preferences.</p>
</li>
<li>The Preferences policy has been updated to allow setting
the preference security.pki.certificate_transparency.mode.</li>
<li>HTTPS-First is now on by default. You can manage this
behavior using the HttpsOnlyMode and HttpAllowlist policies.</li>
<li>An internal change has been made to Firefox that removes
<code>XPCOMUtils.defineLazyGetter</code>. For most people, this
shouldn't matter, but if you encounter problems with
AutoConfig or third party software like PolicyPak, this might
be the cause. You'll need to reach out to your provider.</li>
<li>Firefox now supports the Content Analysis SDK for
integrating DLP software. For more information, see this
post.</li>
<li>
<p>The SearchEngines policy is now available on all versions
of Firefox (not just the ESR).</p>
</li>
<li>
<p>Fixed: Various security fixes.</p>
</li>
</ul>
<p>MFSA 2025-51 (bsc#1244670)
* CVE-2025-6424 (bmo#1966423)
Use-after-free in FontFaceSet
* CVE-2025-6425 (bmo#1717672)
The WebCompat WebExtension shipped with Firefox exposed a
persistent UUID
* CVE-2025-6426 (bmo#1964385)
No warning when opening executable terminal files on macOS
* CVE-2025-6427 (bmo#1966927)
connect-src Content Security Policy restriction could be
bypassed
* CVE-2025-6428 (bmo#1970151)
Firefox for Android opened URLs specified in a link
querystring parameter
* CVE-2025-6429 (bmo#1970658)
Incorrect parsing of URLs could have allowed embedding of
youtube.com
* CVE-2025-6430 (bmo#1971140)
Content-Disposition header ignored when a file is included in
an embed or object tag
* CVE-2025-6431 (bmo#1942716)
The prompt in Firefox for Android that asks before opening a
link in an external application could be bypassed
* CVE-2025-6432 (bmo#1943804)
DNS Requests leaked outside of a configured SOCKS proxy
* CVE-2025-6433 (bmo#1954033)
WebAuthn would allow a user to sign a challenge on a webpage
with an invalid TLS certificate
* CVE-2025-6434 (bmo#1955182)
HTTPS-Only exception screen lacked anti-clickjacking delay
* CVE-2025-6435 (bmo#1950056, bmo#1961777)
Save as in Devtools could download files without sanitizing
the extension
* CVE-2025-6436 (bmo#1941377, bmo#1960948, bmo#1966187,
bmo#1966505, bmo#1970764)
Memory safety bugs fixed in Firefox 140 and Thunderbird 140</p>
<h2>Patch Instructions:</h2>
<p>
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">
<li class="list-group-item">
SUSE Linux Enterprise Server 12 SP5 LTSS
<br/>
<code>zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-2025-2339=1</code>
</li>
<li class="list-group-item">
SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security
<br/>
<code>zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2025-2339=1</code>
</li>
</ul>
<h2>Package List:</h2>
<ul>
<li>
SUSE Linux Enterprise Server 12 SP5 LTSS (aarch64 ppc64le s390x x86_64)
<ul>
<li>MozillaFirefox-140.0-112.270.2</li>
<li>MozillaFirefox-branding-SLE-140-35.19.5</li>
<li>MozillaFirefox-translations-common-140.0-112.270.2</li>
<li>MozillaFirefox-debuginfo-140.0-112.270.2</li>
<li>MozillaFirefox-debugsource-140.0-112.270.2</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server 12 SP5 LTSS (noarch)
<ul>
<li>MozillaFirefox-devel-140.0-112.270.2</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (x86_64)
<ul>
<li>MozillaFirefox-140.0-112.270.2</li>
<li>MozillaFirefox-branding-SLE-140-35.19.5</li>
<li>MozillaFirefox-translations-common-140.0-112.270.2</li>
<li>MozillaFirefox-debuginfo-140.0-112.270.2</li>
<li>MozillaFirefox-debugsource-140.0-112.270.2</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (noarch)
<ul>
<li>MozillaFirefox-devel-140.0-112.270.2</li>
</ul>
</li>
</ul>
<h2>References:</h2>
<ul>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-6424.html">https://www.suse.com/security/cve/CVE-2025-6424.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-6425.html">https://www.suse.com/security/cve/CVE-2025-6425.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-6426.html">https://www.suse.com/security/cve/CVE-2025-6426.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-6427.html">https://www.suse.com/security/cve/CVE-2025-6427.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-6428.html">https://www.suse.com/security/cve/CVE-2025-6428.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-6429.html">https://www.suse.com/security/cve/CVE-2025-6429.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-6430.html">https://www.suse.com/security/cve/CVE-2025-6430.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-6431.html">https://www.suse.com/security/cve/CVE-2025-6431.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-6432.html">https://www.suse.com/security/cve/CVE-2025-6432.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-6433.html">https://www.suse.com/security/cve/CVE-2025-6433.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-6434.html">https://www.suse.com/security/cve/CVE-2025-6434.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-6435.html">https://www.suse.com/security/cve/CVE-2025-6435.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-6436.html">https://www.suse.com/security/cve/CVE-2025-6436.html</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1244670">https://bugzilla.suse.com/show_bug.cgi?id=1244670</a>
</li>
</ul>
</div>