Memory safety bugs present in Firefox 134 and Thunderbird 134. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 135 and Thunderbird < 135.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Memory safety bugs present in Firefox 134 and Thunderbird 134. Some of these bugs showed evidence of     memory corruption and we presume that with enough effort some of these could have been exploited to run     arbitrary code. This vulnerability affects Firefox < 135 and Thunderbird < 135. (CVE-2025-1020)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7263-1 advisory.

    Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially     crafted website, an attacker could potentially exploit these to cause a denial of service, obtain     sensitive information across domains, or execute arbitrary code. (CVE-2025-1011, CVE-2025-1013,     CVE-2025-1014, CVE-2025-1016, CVE-2025-1017, CVE-2025-1018, CVE-2025-1019, CVE-2025-1020)

    Ivan Fratric discovered that Firefox did not properly handle XSLT data, leading to a use-after-free     vulnerability. An attacker could potentially exploit this issue to cause a denial of service, or execute     arbitrary code. (CVE-2025-1009)

    Atte Kettunen discovered that Firefox did not properly manage memory in the Custom Highlight API, leading     to a use-after-free vulnerability. An attacker could potentially exploit this issue to cause a denial of     service, or execute arbitrary code. (CVE-2025-1010)

    Nils Bars discovered that Firefox did not properly manage memory during concurrent delazification, leading     to a use-after-free vulnerability. An attacker could potentially exploit this issue to cause a denial of     service, or execute arbitrary code. (CVE-2025-1012)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-2e627d0672 advisory.

    - Updated to latest upstream (135.0)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the f7ca4ff7-e53f-11ef-a845-b42e991fc52e advisory.

    security@mozilla.org reports:
    Memory safety bugs present in Firefox 134 and Thunderbird 134.  Some             of these bugs showed evidence of memory corruption and we presume             that with enough effort some of these could have been exploited to             run arbitrary code.
    The fullscreen notification is prematurely hidden when fullscreen             is re-requested quickly by the user.  This could have been leveraged             to perform a potential spoofing attack.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-13bbd34b51 advisory.

    - Updated to latest upstream (135.0)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 135.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-07 advisory.

  - Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6,     Thunderbird 115.19, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we     presume that with enough effort some of these could have been exploited to run arbitrary code.
    (CVE-2025-1016)

  - An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable     crash. (CVE-2025-1009)

  - An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially     exploitable crash. (CVE-2025-1010)

  - The fullscreen notification is prematurely hidden when fullscreen is re-requested quickly by the user.
    This could have been leveraged to perform a potential spoofing attack. (CVE-2025-1018)

  - A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker     to leverage this to achieve code execution. (CVE-2025-1011)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 135.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-07 advisory.

  - Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6,     Thunderbird 115.19, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we     presume that with enough effort some of these could have been exploited to run arbitrary code.
    (CVE-2025-1016)

  - An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable     crash. (CVE-2025-1009)

  - An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially     exploitable crash. (CVE-2025-1010)

  - The fullscreen notification is prematurely hidden when fullscreen is re-requested quickly by the user.
    This could have been leveraged to perform a potential spoofing attack. (CVE-2025-1018)

  - A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker     to leverage this to achieve code execution. (CVE-2025-1011)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 135.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-11 advisory.

  - Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6,     Thunderbird 115.19, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we     presume that with enough effort some of these could have been exploited to run arbitrary code.
    (CVE-2025-1016)

  - An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable     crash. (CVE-2025-1009)

  - An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially     exploitable crash. (CVE-2025-1010)

  - The fullscreen notification is prematurely hidden when fullscreen is re-requested quickly by the user.
    This could have been leveraged to perform a potential spoofing attack. (CVE-2025-1018)

  - A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker     to leverage this to achieve code execution. (CVE-2025-1011)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 135.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-11 advisory.

  - Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6,     Thunderbird 115.19, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we     presume that with enough effort some of these could have been exploited to run arbitrary code.
    (CVE-2025-1016)

  - An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable     crash. (CVE-2025-1009)

  - An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially     exploitable crash. (CVE-2025-1010)

  - The fullscreen notification is prematurely hidden when fullscreen is re-requested quickly by the user.
    This could have been leveraged to perform a potential spoofing attack. (CVE-2025-1018)

  - A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker     to leverage this to achieve code execution. (CVE-2025-1011)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
230491	Linux Distros Unpatched Vulnerability : CVE-2025-1020	Nessus	Misc.	critical
216055	Ubuntu 20.04 LTS : Firefox vulnerabilities (USN-7263-1)	Nessus	Ubuntu Local Security Checks	critical
215148	Fedora 40 : firefox (2025-2e627d0672)	Nessus	Fedora Local Security Checks	critical
215140	FreeBSD : mozilla -- multiple vulnerabilities (f7ca4ff7-e53f-11ef-a845-b42e991fc52e)	Nessus	FreeBSD Local Security Checks	critical
215076	Fedora 41 : firefox (2025-13bbd34b51)	Nessus	Fedora Local Security Checks	critical
214965	Mozilla Firefox < 135.0	Nessus	Windows	critical
214964	Mozilla Firefox < 135.0	Nessus	MacOS X Local Security Checks	critical
214955	Mozilla Thunderbird < 135.0	Nessus	Windows	critical
214954	Mozilla Thunderbird < 135.0	Nessus	MacOS X Local Security Checks	critical

Detections

Analytics

CVE-2025-1020

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical