97 matches found
Mozilla: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3
A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as: Memory safety bugs are present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence of memory corruption, and we presume that with enough effort, some of these cou...
CVE-2023-4582
Due to large allocation checks in Angle for glsl shaders being too lenient a buffer overflow could have occurred when allocating too much private shader memory on mac OS. This bug only affects Firefox on macOS. Other operating systems are unaffected. This vulnerability affects Firefox 117, Firefo...
CVE-2023-37201
An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS. This vulnerability affects Firefox 115, Firefox ESR 102.13, and Thunderbird 102.13...
Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9
A flaw was found in Mozilla. The Mozilla Foundation Security Advisory described the issue in which Mozilla developers Timothy Nikkel, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 110 and ESR 102.8. Some of these bugs showed evidence of memory...
Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9
A flaw was found in Mozilla. The Mozilla Foundation Security Advisory described the issue in which Mozilla developers Timothy Nikkel, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 110 and ESR 102.8. Some of these bugs showed evidence of memory...
SUSE CVE-2013-1692
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not prevent the inclusion of body data in an XMLHttpRequest HEAD request, which makes it easier for remote attackers to conduct cross-site request forgery CSRF attacks...
SUSE CVE-2016-1526
The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, incorrectly validates a size value, which allows remote attackers to obtain sensitive information or cause a denial of service out-of-bound...
SUSE CVE-2017-7830
The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-origin policy violation and could allow for data theft of URLs loaded by users. This vulnerability affects Firefox 57, Firefox ESR 52.5, and Thunderbird 52.5...
CVE-2022-29916
Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables. This could have been used to probe the browser history. This vulnerability affects Thunderbird 91.9, Firefox ESR 91.9, and Firefox 100...
CVE-2022-31738
When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user confusion or spoofing attacks. This vulnerability affects Thunderbird 91.10, Firefox 101, and Firefox ESR 91.10...
CVE-2022-40957
Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially exploitable crash.This bug only affects Firefox on ARM64 platforms.. This vulnerability affects Firefox ESR 102.3, Thunderbird 102.3, and Firefox 105...
Mozilla Firefox ESR < 91.8
The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 91.8. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-14 advisory. - Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla...
CVE-2021-43534
Mozilla developers and community members reported memory safety bugs present in Firefox 93 and Firefox ESR 91.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects...
Mozilla: Content Security Policy violation report could have contained the destination of a redirect
If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation report; as opposed to the original frame URI. This could be used to leak sensitive information contained in such URIs. This vulnerability affects Firefox 86,...
Mozilla: DoH did not filter IPv4 mapped IP Addresses
When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses as these do not make sense coming from a DoH resolver. However when an IPv4 address was mapped through IPv6, these addresses were erroneously let through, leading to a potential DNS Rebinding...
PT-2020-6426 · Ckeditor +1 · Ckeditor +1
Name of the Vulnerable Software and Affected Versions: CiviCRM versions prior to 5.28.1 CiviCRM ESR versions prior to 5.27.5 ESR Description: The issue is related to the CKEditor configuration form in CiviCRM, which allows Cross-Site Request Forgery CSRF. This could potentially allow a remote...
[SECURITY] [DLA 2297-1] firefox-esr security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-2297-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort July 29, 2020 https://wiki.debian.org/LTS -...
Security fix for the ALT Linux 10 package firefox-esr version 68.6.0-alt1
March 10, 2020 Andrey Cherepanov 68.6.0-alt1 - New ESR version 68.6.0. - Fix license tag according to SPDX. - Fixed: + CVE-2020-6805 Use-after-free when removing data about origins + CVE-2020-6806 BodyStream::OnInputStreamReady was missing protections against state confusion + CVE-2020-6807...
Mozilla: Memory safety bugs fixed in Firefox 73 and Firefox ESR 68.5
Mozilla developers and community members reported memory safety bugs present in Firefox 72 and Firefox ESR 68.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. In general, these flaws...