CVE-2022-31744

An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so bypass a page's Content Security Policy. This vulnerability affects Firefox ESR 91.11, Thunderbird 102, Thunderbird 91.11, and Firefox 101...

CVE-2022-29916

Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables. This could have been used to probe the browser history. This vulnerability affects Thunderbird 91.9, Firefox ESR 91.9, and Firefox 100...

CVE-2022-40957

Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially exploitable crash.This bug only affects Firefox on ARM64 platforms.. This vulnerability affects Firefox ESR 102.3, Thunderbird 102.3, and Firefox 105...

CVE-2022-26485

Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox 97.0.2, Firefox ESR 91.6.1, Firefox for Android 97.3.0, Thunderbird 91.6.2, and Focus 97.3.0. Recent...

CVE-2022-45405

Freeing arbitrary nsIInputStream's on a different thread than creation could have led to a use-after-free and potentially exploitable crash. This vulnerability affects Firefox ESR 102.5, Thunderbird 102.5, and Firefox 107...

CVE-2022-22739

CVE-2022-22739 describes a vulnerability where malicious websites could lure users into launching a program to handle an external URL protocol. Public references in the provided documents indicate affected products are Mozilla Firefox (Firefox ESR < 91.5, Firefox < 96) and Thunderbird (

CVE-2022-22747

After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have lead to a crash. This crash is believed to be unexploitable. This vulnerability affects Firefox ESR 91.5, Firefox 96, and Thunderbird 91.5...

CVE-2022-3266

An out-of-bounds read can occur when decoding H264 video. This results in a potentially exploitable crash. This vulnerability affects Firefox ESR 102.3, Thunderbird 102.3, and Firefox 105...

CVE-2022-22759

The CVE-2022-22759 issue describes a flaw where a sandboxed iframe that lacks allow-scripts could still execute an appended element’s JavaScript (e.g., event handlers) when that element is added to the iframe’s document. Affected products and versions include Firefox < 97, Thunderbird < 91....

CVE-2022-22747

Summary: CVE-2022-22747 describes a denial of service caused by incorrect parsing of empty PKCS#7 sequences after accepting an untrusted certificate, leading to a crash. The vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird

CVE-2022-1196

After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Thunderbird 91.8 and Firefox ESR 91.8...

CVE-2022-22737

The CVE-2022-22737 entry is supported by connected advisories showing a race condition in constructing audio sinks that can lead to a use-after-free and potentially exploitable crash in Mozilla Firefox ESR < 91.5, Firefox < 96, and Thunderbird

CVE-2022-45404

CVE-2022-45404 : The vulnerability is a fullscreen notification bypass caused by a sequence of popup/window.print() calls that lets a window go fullscreen without the user prompt. Affected products include Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox

CVE-2022-38477

CVE-2022-38477 concerns memory safety bugs reported by Mozilla’s Fuzzing Team in Firefox 103 and Firefox ESR 102.1. The entry notes evidence of memory corruption and a presumption that, with sufficient effort, some bugs could be exploited to execute arbitrary code. Affected products explicitly li...

CVE-2022-46874

CVE-2022-46874 describes a filename truncation issue where a long filename could lose its valid extension, leaving a malicious extension that could confuse users or lead to execution of malicious code. Public reports indicate affected products include Firefox versions before 108 and Thunderbird v...

CVE-2022-40956

When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead. This vulnerability affects Firefox ESR 102.3, Thunderbird 102.3, and Firefox 105...

CVE-2022-22742

CVE-2022-22742 is confirmed in connected records as an out-of-bounds memory access in Firefox/Thunderbird when inserting text in edit mode. Affected products include Firefox ESR < 91.5, Firefox < 96, and Thunderbird

CVE-2022-46874

A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place. This could potentially led to user confusion and the execution of malicious code.Note: This issue was originally included in the advisories for Thunderbird...

Security fix for the ALT Linux 10 package firefox-esr version 102.6.0-alt1

102.6.0-alt1 built Dec. 22, 2022 Pavel Vasenkov in task 311776 Dec. 14, 2022 Pavel Vasenkov - New ESR version. - Security fixes + CVE-2022-46880 Use-after-free in WebGL + CVE-2022-46872 Arbitrary file read from a compromised content process + CVE-2022-46881 Memory corruption in WebGL +...

CVE-2022-34470

CVE-2022-34470 is a real-use-after-free vulnerability in Firefox/Thunderbird related to session-history navigations that could cause a crash. The connected documents identify the affected products and versions: Firefox and Firefox ESR (Firefox < 102, ESR < 91.11) and Thunderbird (Thunderbir...