{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "libmozjs-128-0-128.8.1-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the libmozjs-128-0-128.8.1-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2025-14958",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_14958-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2025:14958-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MZKGV75ZSDUQ4HV5GEU5SXQRWEVYV5SQ/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2025:14958-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MZKGV75ZSDUQ4HV5GEU5SXQRWEVYV5SQ/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-43097 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-43097/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-1931 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-1931/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-1935 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-1935/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-2857 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-2857/"
      }
    ],
    "title": "libmozjs-128-0-128.8.1-1.1 on GA media",
    "tracking": {
      "current_release_date": "2025-04-02T00:00:00Z",
      "generator": {
        "date": "2025-04-02T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2025:14958-1",
      "initial_release_date": "2025-04-02T00:00:00Z",
      "revision_history": [
        {
          "date": "2025-04-02T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libmozjs-128-0-128.8.1-1.1.aarch64",
                "product": {
                  "name": "libmozjs-128-0-128.8.1-1.1.aarch64",
                  "product_id": "libmozjs-128-0-128.8.1-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "mozjs128-128.8.1-1.1.aarch64",
                "product": {
                  "name": "mozjs128-128.8.1-1.1.aarch64",
                  "product_id": "mozjs128-128.8.1-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "mozjs128-devel-128.8.1-1.1.aarch64",
                "product": {
                  "name": "mozjs128-devel-128.8.1-1.1.aarch64",
                  "product_id": "mozjs128-devel-128.8.1-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libmozjs-128-0-128.8.1-1.1.ppc64le",
                "product": {
                  "name": "libmozjs-128-0-128.8.1-1.1.ppc64le",
                  "product_id": "libmozjs-128-0-128.8.1-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "mozjs128-128.8.1-1.1.ppc64le",
                "product": {
                  "name": "mozjs128-128.8.1-1.1.ppc64le",
                  "product_id": "mozjs128-128.8.1-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "mozjs128-devel-128.8.1-1.1.ppc64le",
                "product": {
                  "name": "mozjs128-devel-128.8.1-1.1.ppc64le",
                  "product_id": "mozjs128-devel-128.8.1-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libmozjs-128-0-128.8.1-1.1.s390x",
                "product": {
                  "name": "libmozjs-128-0-128.8.1-1.1.s390x",
                  "product_id": "libmozjs-128-0-128.8.1-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "mozjs128-128.8.1-1.1.s390x",
                "product": {
                  "name": "mozjs128-128.8.1-1.1.s390x",
                  "product_id": "mozjs128-128.8.1-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "mozjs128-devel-128.8.1-1.1.s390x",
                "product": {
                  "name": "mozjs128-devel-128.8.1-1.1.s390x",
                  "product_id": "mozjs128-devel-128.8.1-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libmozjs-128-0-128.8.1-1.1.x86_64",
                "product": {
                  "name": "libmozjs-128-0-128.8.1-1.1.x86_64",
                  "product_id": "libmozjs-128-0-128.8.1-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "mozjs128-128.8.1-1.1.x86_64",
                "product": {
                  "name": "mozjs128-128.8.1-1.1.x86_64",
                  "product_id": "mozjs128-128.8.1-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "mozjs128-devel-128.8.1-1.1.x86_64",
                "product": {
                  "name": "mozjs128-devel-128.8.1-1.1.x86_64",
                  "product_id": "mozjs128-devel-128.8.1-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libmozjs-128-0-128.8.1-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.aarch64"
        },
        "product_reference": "libmozjs-128-0-128.8.1-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libmozjs-128-0-128.8.1-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.ppc64le"
        },
        "product_reference": "libmozjs-128-0-128.8.1-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libmozjs-128-0-128.8.1-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.s390x"
        },
        "product_reference": "libmozjs-128-0-128.8.1-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libmozjs-128-0-128.8.1-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.x86_64"
        },
        "product_reference": "libmozjs-128-0-128.8.1-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mozjs128-128.8.1-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.aarch64"
        },
        "product_reference": "mozjs128-128.8.1-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mozjs128-128.8.1-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.ppc64le"
        },
        "product_reference": "mozjs128-128.8.1-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mozjs128-128.8.1-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.s390x"
        },
        "product_reference": "mozjs128-128.8.1-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mozjs128-128.8.1-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.x86_64"
        },
        "product_reference": "mozjs128-128.8.1-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mozjs128-devel-128.8.1-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.aarch64"
        },
        "product_reference": "mozjs128-devel-128.8.1-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mozjs128-devel-128.8.1-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.ppc64le"
        },
        "product_reference": "mozjs128-devel-128.8.1-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mozjs128-devel-128.8.1-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.s390x"
        },
        "product_reference": "mozjs128-devel-128.8.1-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mozjs128-devel-128.8.1-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.x86_64"
        },
        "product_reference": "mozjs128-devel-128.8.1-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-43097",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-43097"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In resizeToAtLeast of SkRegion.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.aarch64",
          "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.ppc64le",
          "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.s390x",
          "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.x86_64",
          "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.aarch64",
          "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.ppc64le",
          "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.s390x",
          "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.x86_64",
          "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.aarch64",
          "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.ppc64le",
          "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.s390x",
          "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-43097",
          "url": "https://www.suse.com/security/cve/CVE-2024-43097"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1237683 for CVE-2024-43097",
          "url": "https://bugzilla.suse.com/1237683"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.aarch64",
            "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.ppc64le",
            "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.s390x",
            "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.x86_64",
            "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.aarch64",
            "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.ppc64le",
            "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.s390x",
            "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.x86_64",
            "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.aarch64",
            "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.ppc64le",
            "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.s390x",
            "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.aarch64",
            "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.ppc64le",
            "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.s390x",
            "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.x86_64",
            "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.aarch64",
            "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.ppc64le",
            "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.s390x",
            "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.x86_64",
            "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.aarch64",
            "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.ppc64le",
            "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.s390x",
            "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-04-02T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-43097"
    },
    {
      "cve": "CVE-2025-1931",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-1931"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "It was possible to cause a use-after-free in the content process side of a WebTransport connection, leading to a potentially exploitable crash. This vulnerability affects Firefox \u003c 136, Firefox ESR \u003c 115.21, Firefox ESR \u003c 128.8, Thunderbird \u003c 136, and Thunderbird \u003c 128.8.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.aarch64",
          "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.ppc64le",
          "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.s390x",
          "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.x86_64",
          "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.aarch64",
          "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.ppc64le",
          "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.s390x",
          "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.x86_64",
          "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.aarch64",
          "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.ppc64le",
          "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.s390x",
          "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-1931",
          "url": "https://www.suse.com/security/cve/CVE-2025-1931"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1237683 for CVE-2025-1931",
          "url": "https://bugzilla.suse.com/1237683"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.aarch64",
            "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.ppc64le",
            "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.s390x",
            "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.x86_64",
            "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.aarch64",
            "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.ppc64le",
            "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.s390x",
            "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.x86_64",
            "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.aarch64",
            "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.ppc64le",
            "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.s390x",
            "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.aarch64",
            "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.ppc64le",
            "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.s390x",
            "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.x86_64",
            "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.aarch64",
            "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.ppc64le",
            "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.s390x",
            "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.x86_64",
            "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.aarch64",
            "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.ppc64le",
            "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.s390x",
            "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-04-02T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-1931"
    },
    {
      "cve": "CVE-2025-1935",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-1935"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A web page could trick a user into setting that site as the default handler for a custom URL protocol. This vulnerability affects Firefox \u003c 136, Firefox ESR \u003c 128.8, Thunderbird \u003c 136, and Thunderbird \u003c 128.8.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.aarch64",
          "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.ppc64le",
          "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.s390x",
          "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.x86_64",
          "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.aarch64",
          "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.ppc64le",
          "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.s390x",
          "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.x86_64",
          "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.aarch64",
          "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.ppc64le",
          "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.s390x",
          "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-1935",
          "url": "https://www.suse.com/security/cve/CVE-2025-1935"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1237683 for CVE-2025-1935",
          "url": "https://bugzilla.suse.com/1237683"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.aarch64",
            "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.ppc64le",
            "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.s390x",
            "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.x86_64",
            "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.aarch64",
            "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.ppc64le",
            "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.s390x",
            "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.x86_64",
            "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.aarch64",
            "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.ppc64le",
            "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.s390x",
            "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.aarch64",
            "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.ppc64le",
            "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.s390x",
            "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.x86_64",
            "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.aarch64",
            "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.ppc64le",
            "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.s390x",
            "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.x86_64",
            "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.aarch64",
            "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.ppc64le",
            "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.s390x",
            "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-04-02T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-1935"
    },
    {
      "cve": "CVE-2025-2857",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-2857"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape. \nThe original vulnerability was being exploited in the wild. \n*This only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox \u003c 136.0.4, Firefox ESR \u003c 128.8.1, and Firefox ESR \u003c 115.21.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.aarch64",
          "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.ppc64le",
          "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.s390x",
          "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.x86_64",
          "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.aarch64",
          "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.ppc64le",
          "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.s390x",
          "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.x86_64",
          "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.aarch64",
          "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.ppc64le",
          "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.s390x",
          "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-2857",
          "url": "https://www.suse.com/security/cve/CVE-2025-2857"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1240140 for CVE-2025-2857",
          "url": "https://bugzilla.suse.com/1240140"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.aarch64",
            "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.ppc64le",
            "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.s390x",
            "openSUSE Tumbleweed:libmozjs-128-0-128.8.1-1.1.x86_64",
            "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.aarch64",
            "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.ppc64le",
            "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.s390x",
            "openSUSE Tumbleweed:mozjs128-128.8.1-1.1.x86_64",
            "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.aarch64",
            "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.ppc64le",
            "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.s390x",
            "openSUSE Tumbleweed:mozjs128-devel-128.8.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-04-02T00:00:00Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2025-2857"
    }
  ]
}