CVS commit: pkgsrc/www/firefox128

["David H. Gutteridge" <gutteridge%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   gutteridge
Date:           Sun Aug 24 04:51:23 UTC 2025

Modified Files:
        pkgsrc/www/firefox128: Makefile distinfo

Log Message:
firefox128: update to 128.14

Mozilla Foundation Security Advisory 2025-66
Security Vulnerabilities fixed in Firefox ESR 128.14

Announced
    August 19, 2025
Impact
    high
Products
    Firefox ESR
Fixed in

        Firefox ESR 128.14

#CVE-2025-9179: Sandbox escape due to invalid pointer in the Audio/Video: GMP component

Reporter
    Oskar
Impact
    high

Description

An attacker was able to perform memory corruption in the GMP process which processes encrypted media. This process is also heavily sandboxed, but represents slightly different privileges from the 
content process.
References

    Bug 1979527

#CVE-2025-9180: Same-origin policy bypass in the Graphics: Canvas2D component

Reporter
    Tom Van Goethem
Impact
    high

Description

'Same-origin policy bypass in the Graphics: Canvas2D component.'
References

    Bug 1979782

#CVE-2025-9181: Uninitialized memory in the JavaScript Engine component

Reporter
    Irvan Kurniawan
Impact
    moderate

Description

Uninitialized memory in the JavaScript Engine component.
References

    Bug 1977130

#CVE-2025-9185: Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142

Reporter
    The Mozilla Fuzzing Team
Impact
    high

Description

Memory safety bugs present in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141. Some of these bugs showed 
evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
References

    Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142


To generate a diff of this commit:
cvs rdiff -u -r1.28 -r1.29 pkgsrc/www/firefox128/Makefile
cvs rdiff -u -r1.18 -r1.19 pkgsrc/www/firefox128/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/firefox128/Makefile
diff -u pkgsrc/www/firefox128/Makefile:1.28 pkgsrc/www/firefox128/Makefile:1.29
--- pkgsrc/www/firefox128/Makefile:1.28 Tue Jul 22 23:38:54 2025
+++ pkgsrc/www/firefox128/Makefile      Sun Aug 24 04:51:23 2025
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.28 2025/07/22 23:38:54 gutteridge Exp $
+# $NetBSD: Makefile,v 1.29 2025/08/24 04:51:23 gutteridge Exp $
 
 FIREFOX_VER=           ${MOZ_BRANCH}${MOZ_BRANCH_MINOR}
-MOZ_BRANCH=            128.13
+MOZ_BRANCH=            128.14
 MOZ_BRANCH_MINOR=      .0esr
 
 DISTNAME=      firefox-${FIREFOX_VER}.source

Index: pkgsrc/www/firefox128/distinfo
diff -u pkgsrc/www/firefox128/distinfo:1.18 pkgsrc/www/firefox128/distinfo:1.19
--- pkgsrc/www/firefox128/distinfo:1.18 Tue Jul 22 23:38:54 2025
+++ pkgsrc/www/firefox128/distinfo      Sun Aug 24 04:51:23 2025
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.18 2025/07/22 23:38:54 gutteridge Exp $
+$NetBSD: distinfo,v 1.19 2025/08/24 04:51:23 gutteridge Exp $
 
-BLAKE2s (firefox-128.13.0esr.source.tar.xz) = 5124b6be09d48b9e2991c0f6ab38b2120c3bdbef7f6847c8df37ceb30adcb829
-SHA512 (firefox-128.13.0esr.source.tar.xz) = 9e6f3af535e0904219bcac947d458789cc43cbfaf476ac287328323662391eaaadeff57b244599acf3626a2fadc0bc41b70d07e33ca6af4412006ad01ceff034
-Size (firefox-128.13.0esr.source.tar.xz) = 560782432 bytes
+BLAKE2s (firefox-128.14.0esr.source.tar.xz) = a3cc3c29528e11e4a25d67ac536bc00bdb09aaaddb21f36586e9a30a1dc412cb
+SHA512 (firefox-128.14.0esr.source.tar.xz) = a3cf267e82b6f5ab8b6497a62b12f85afb78fcaef6b12c43ef79564ce8270d3327a873368ce48fc018e46fef5e07339c07b9a494a5ff6c22a84099f939f6a9de
+Size (firefox-128.14.0esr.source.tar.xz) = 562714012 bytes
 BLAKE2s (nodejs-output-128.0.tgz) = a55b907ebe308948b99b9150d2530204c8fe2a5fda5ac371dd1163a6db43bcbc
 SHA512 (nodejs-output-128.0.tgz) = fba59ec14c43556749cac7a9233278e8dcd7779d5ba530ede67009bf1887c5d72dd31e3f440164b646738b465d852b882522caf7ed9aa4f81f53e588bdd3adec
 Size (nodejs-output-128.0.tgz) = 227482 bytes