CVE-2025-0239

MEDIUM

Firefox < 134 & Thunderbird < 128.6 - SSL Validation

Title source: llm

Description

When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.

References (6)

[Mailing List] https://lists.debian.org/debian-lts-announce/2025/01/msg00004.html

[Issue Tracking, Permissions Required] https://bugzilla.mozilla.org/show_bug.cgi?id=1929156

[Vendor Advisory] https://www.mozilla.org/security/advisories/mfsa2025-01/

[Vendor Advisory] https://www.mozilla.org/security/advisories/mfsa2025-02/

[Vendor Advisory] https://www.mozilla.org/security/advisories/mfsa2025-04/

[Vendor Advisory] https://www.mozilla.org/security/advisories/mfsa2025-05/

Scores

CVSS v3 4.0

EPSS 0.0003

EPSS Percentile 8.6%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-295

Status published

Products (7)

mozilla/firefox < 128.6.0

mozilla/firefox < 134.0

Mozilla/Firefox 128.6 - 128.*

Mozilla/Firefox 134

mozilla/thunderbird < 128.6.0

Mozilla/Thunderbird 128.6 - 128.*

Mozilla/Thunderbird 134

Published Jan 07, 2025

Tracked Since Feb 18, 2026