An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object. This vulnerability affects Firefox < 138.0.4, Firefox ESR < 128.10.1, and Firefox ESR < 115.23.1.

The version of mozilla-firefox installed on the remote host is prior to 128.10.1esr. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2025-138-01 advisory.

    New mozilla-firefox packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the mozilla-firefox security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 115.23.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-38 advisory.

  - An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array     index sizes. (CVE-2025-4919)

  - An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object.
    (CVE-2025-4918)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 115.23.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-38 advisory.

  - An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array     index sizes. (CVE-2025-4919)

  - An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object.
    (CVE-2025-4918)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 138.0.4. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-36 advisory.

  - An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array     index sizes. (CVE-2025-4919)

  - An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object.
    (CVE-2025-4918)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 138.0.4. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-36 advisory.

  - An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array     index sizes. (CVE-2025-4919)

  - An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object.
    (CVE-2025-4918)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 128.10.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-37 advisory.

  - An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array     index sizes. (CVE-2025-4919)

  - An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object.
    (CVE-2025-4918)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 128.10.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-37 advisory.

  - An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array     index sizes. (CVE-2025-4919)

  - An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object.
    (CVE-2025-4918)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
236931	Slackware Linux 15.0 / current mozilla-firefox Multiple Vulnerabilities (SSA:2025-138-01)	Nessus	Slackware Local Security Checks	high
236893	Mozilla Firefox ESR < 115.23.1	Nessus	MacOS X Local Security Checks	high
236892	Mozilla Firefox ESR < 115.23.1	Nessus	Windows	high
236891	Mozilla Firefox < 138.0.4	Nessus	MacOS X Local Security Checks	high
236890	Mozilla Firefox < 138.0.4	Nessus	Windows	high
236889	Mozilla Firefox ESR < 128.10.1	Nessus	Windows	high
236888	Mozilla Firefox ESR < 128.10.1	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2025-4918

high

Tenable Plugins

high

high

high

high

high

high

high