CVE-2025-1936

Name	CVE-2025-1936
Description	jar: URLs retrieve local file content packaged in a ZIP archive. The null and everything after it was ignored when retrieving the content from the archive, but the fake extension after the null was used to determine the type of content. This could have been used to hide code in a web extension disguised as something else like an image. This vulnerability affects Firefox < 136, Firefox ESR < 128.8, Thunderbird < 136, and Thunderbird < 128.8.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-5874-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
firefox (PTS)	sid	136.0-1	fixed
firefox-esr (PTS)	bullseye	115.14.0esr-1~deb11u1	vulnerable
	bullseye (security)	128.7.0esr-1~deb11u1	vulnerable
	bookworm	128.5.0esr-1~deb12u1	vulnerable
	bookworm (security)	128.8.0esr-1~deb12u1	fixed
	trixie	128.7.0esr-1	vulnerable
	sid	128.8.0esr-1	fixed
thunderbird (PTS)	bullseye	1:115.12.0-1~deb11u1	vulnerable
	bullseye (security)	1:128.7.0esr-1~deb11u1	vulnerable
	bookworm	1:128.5.0esr-1~deb12u1	vulnerable
	bookworm (security)	1:128.7.0esr-1~deb12u1	vulnerable
	sid, trixie	1:128.7.0esr-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
firefox	source	(unstable)	136.0-1
firefox-esr	source	bookworm	128.8.0esr-1~deb12u1	DSA-5874-1
firefox-esr	source	(unstable)	128.8.0esr-1
thunderbird	source	(unstable)	(unfixed)

Notes

https://www.mozilla.org/en-US/security/advisories/mfsa2025-14/#CVE-2025-1936
https://www.mozilla.org/en-US/security/advisories/mfsa2025-16/#CVE-2025-1936
https://www.mozilla.org/en-US/security/advisories/mfsa2025-18/#CVE-2025-1936