A vulnerability was found in gorhill uBlock Origin up to 1.63.3b16. It has been classified as problematic. Affected is the function currentStateChanged of the file src/js/1p-filters.js of the component UI. The manipulation leads to inefficient regular expression complexity. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.63.3b17 is able to address this issue. The patch is identified as eaedaf5b10d2f7857c6b77fbf7d4a80681d4d46c. It is recommended to upgrade the affected component.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-01794be9b3 advisory.

    Latest upstream release. Changelog: https://github.com/gorhill/uBlock/releases/tag/1.64.0 .

    Fixes CVE-2025-4215 .

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4215 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4215-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     June 12, 2025                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : ublock-origin     Version        : 1.62.0+dfsg-0+deb11u1     CVE ID         : CVE-2025-4215     Debian Bug     : 1104635

    A flaw was found in ublock-origin, a lightweight and efficient ads, malware,     trackers blocker. A remote attacker could abuse an inefficient regular     expression in ublock-origin's filters to cause a denial-of-service and freeze a     web browser.

    For Debian 11 bullseye, this problem has been fixed in version     1.62.0+dfsg-0+deb11u1.

    We recommend that you upgrade your ublock-origin packages.

    For the detailed security status of ublock-origin please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/ublock-origin

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-b0f2570b61 advisory.

    Latest upstream release. Changelog: https://github.com/gorhill/uBlock/releases/tag/1.64.0 .

    Fixes CVE-2025-4215 .

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
238329	Fedora 42 : mozilla-ublock-origin (2025-01794be9b3)	Nessus	Fedora Local Security Checks	low
238248	Debian dla-4215 : ublock-origin-doc - security update	Nessus	Debian Local Security Checks	low
237406	Fedora 41 : mozilla-ublock-origin (2025-b0f2570b61)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2025-4215

low

Tenable Plugins

low

low

low