ANCHORE-2025-0239

ANCHORE-2025-0239 PUBLISHED

When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerability affects Firefox < 134, Firefox ESR < 128.6, Thunderbird < 134, and Thunderbird < 128.6.

Affected Products

Vendor	Product	Versions
Mozilla	Firefox ESR	0, 0, 0
Mozilla	Thunderbird	129, 0, 129
Mozilla	Firefox	0, 0, 0

Timeline

Jan 7, 2025 CVE Published
Jan 13, 2025 CVE Updated

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1929156 url
https://www.mozilla.org/security/advisories/mfsa2025-01/ url
https://www.mozilla.org/security/advisories/mfsa2025-02/ url
https://www.mozilla.org/security/advisories/mfsa2025-04/ url
https://www.mozilla.org/security/advisories/mfsa2025-05/ url

Open in Interactive Console →