CVE-2025-3608 - Vulnerability Details - OpenCVE

A race condition existed in nsHttpTransaction that could have been exploited to cause memory corruption, potentially leading to an exploitable condition. This vulnerability affects Firefox < 137.0.2.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

References

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=1951554
https://nvd.nist.gov/vuln/detail/CVE-2025-3608
https://www.cve.org/CVERecord?id=CVE-2025-3608
https://www.mozilla.org/security/advisories/mfsa2025-25/

History

Sat, 19 Apr 2025 02:00:00 +0000

Type	Values Removed	Values Added
Title		firefox: Race condition in nsHttpTransaction could lead to memory corruption
Weaknesses		CWE-364
References		https://nvd.nist.gov/vuln/detail/CVE-2025-3608
Metrics	threat_severity `None`	threat_severity `Important`

Fri, 18 Apr 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N'}`

Thu, 17 Apr 2025 18:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 15 Apr 2025 13:00:00 +0000

Type	Values Removed	Values Added
Description		A race condition existed in nsHttpTransaction that could have been exploited to cause memory corruption, potentially leading to an exploitable condition. This vulnerability affects Firefox < 137.0.2.
References		https://bugzilla.mozilla.org/show_bug.cgi?id=1951554 https://www.cve.org/CVERecord?id=CVE-2025-3608 https://www.mozilla.org/security/advisories/mfsa2025-25/

MITRE

Status: PUBLISHED

Assigner: mozilla

Published: 2025-04-15T12:57:28.868Z

Updated: 2025-04-18T14:43:41.037Z

Reserved: 2025-04-14T20:03:44.238Z

Link: CVE-2025-3608

Vulnrichment

Updated: 2025-04-17T17:46:52.935Z

NVD

Status : Awaiting Analysis

Published: 2025-04-15T13:15:55.590

Modified: 2025-04-18T15:15:59.183

Link: CVE-2025-3608

Redhat

Severity : Important

Publid Date: 2025-04-15T12:57:28Z

Links: CVE-2025-3608 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-3608", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "state": "PUBLISHED", "assignerShortName": "mozilla", "dateReserved": "2025-04-14T20:03:44.238Z", "datePublished": "2025-04-15T12:57:28.868Z", "dateUpdated": "2025-04-18T14:43:41.037Z"}, "containers": {"cna": {"affected": [{"product": "Firefox", "vendor": "Mozilla", "versions": [{"lessThan": "137.0.2", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "A race condition existed in nsHttpTransaction that could have been exploited to cause memory corruption, potentially leading to an exploitable condition. This vulnerability affects Firefox < 137.0.2.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A race condition existed in nsHttpTransaction that could have been exploited to cause memory corruption, potentially leading to an exploitable condition. This vulnerability affects Firefox < 137.0.2."}]}], "problemTypes": [{"descriptions": [{"description": "Race condition in nsHttpTransaction could lead to memory corruption", "lang": "en", "type": "text"}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1951554"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2025-3608", "name": "CVE-2025-3608"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-25/"}], "credits": [{"lang": "en", "value": "The Mozilla Fuzzing Team"}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2025-04-15T12:57:28.868Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-362", "lang": "en", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-04-16T03:55:07.062337Z", "id": "CVE-2025-3608", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-18T14:43:41.037Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3608", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-16T03:55:07.062337Z"}}}, {"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-17T17:46:52.935Z"}}], "cna": {"credits": [{"lang": "en", "value": "The Mozilla Fuzzing Team"}], "affected": [{"vendor": "Mozilla", "product": "Firefox", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "137.0.2", "versionType": "custom"}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1951554"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2025-3608", "name": "CVE-2025-3608"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-25/"}], "descriptions": [{"lang": "en", "value": "A race condition existed in nsHttpTransaction that could have been exploited to cause memory corruption, potentially leading to an exploitable condition. This vulnerability affects Firefox < 137.0.2.", "supportingMedia": [{"type": "text/html", "value": "A race condition existed in nsHttpTransaction that could have been exploited to cause memory corruption, potentially leading to an exploitable condition. This vulnerability affects Firefox < 137.0.2.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Race condition in nsHttpTransaction could lead to memory corruption"}]}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2025-04-15T12:57:28.868Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3608", "state": "PUBLISHED", "dateUpdated": "2025-04-17T17:46:59.564Z", "dateReserved": "2025-04-14T20:03:44.238Z", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "datePublished": "2025-04-15T12:57:28.868Z", "assignerShortName": "mozilla"}, "dataVersion": "5.1"}