Astra Linux – Vulnerability in Firefox

When sharing geolocation during an active WebRTC share, Firefox may reset the WebRTC sharing state in the user interface, resulting in a loss of control over the currently granted permissions. This vulnerability affects Firefox versions earlier than 85...

Astra Linux – Vulnerability in Firefox and Thunderbird

The use of the new logical assignment operators in a JavaScript switch statement could lead to a type confusion, resulting in memory corruption and potentially exploitable crashes. This vulnerability affects Firefox 85, Thunderbird 78.7, and Firefox ESR 78.7...

Astra Linux – Vulnerability in Firefox

The incorrect use of the '' method could lead to a “user-after-poison” situation and potentially cause a exploitable crash. This vulnerability affects Firefox versions earlier than 85...

Astra Linux – Vulnerability in Firefox

One phishing tactic on the internet involves providing a link with HTTP Auth. For example, it might look like “https://[email protected]”. To mitigate this type of attack, Firefox will display a warning dialog box. However, this warning dialog would not be shown if evil.com used a...

Astra Linux – Vulnerability in Firefox

Due to unexpected data type conversions, a use-after-free might have occurred when interacting with the font cache. We assume that with sufficient effort, this vulnerability could have been exploited to execute arbitrary code. This vulnerability affects Firefox versions earlier than 88...

Astra Linux – Vulnerability in Firefox and Thunderbird

When combining CSS properties for overflow and transform, the mouse cursor may interact with coordinates that differ from those displayed. This vulnerability affects Firefox ESR 102.1, Firefox ESR 91.12, Firefox 103, Thunderbird 102.1, and Thunderbird 91.12...

Astra Linux – Vulnerability in Firefox

By using XSL Transforms, a malicious webserver could serve a user an XSL document that would continue to execute JavaScript within the bounds of the same-origin policy even after the tab was closed. This vulnerability affects Firefox versions earlier than 97...

Astra Linux – Vulnerability in Firefox

An attacker who could have convinced a user to drag and drop an image into a file system could have manipulated the resulting filename to include an executable extension. By doing so, the attacker could potentially trick the user into executing malicious code. Although very similar, this is a...

Astra Linux – Vulnerability in Firefox, Thunderbird

Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin leak attacks. This vulnerability was fixed in Firefox 139, Firefox ESR 115.24, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11...

Astra Linux – Vulnerability in Firefox

In violation of the specification, cookie prefixes such as Secure were ignored if they were not capitalized correctly. According to the specification, these prefixes should be checked using a case-insensitive comparison. This could result in the browser not correctly implementing the behaviors...

Astra Linux – Vulnerability in Thunderbird, Firefox

A carefully crafted URL containing specific Unicode characters could conceal the true origin of the page, leading to a potential spoofing attack. This vulnerability was fixed in Firefox 137, Firefox ESR 128.9, Thunderbird 137, and Thunderbird 128.9...

Astra Linux – Vulnerability in Firefox

Bypass of the same-origin policy in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 148.0.2...

Astra Linux – Vulnerability in Firefox

The developer’s page for about:memory includes a Measure function for exploring which object types the browser has allocated and their sizes. When this function was invoked, we incorrectly called the sizeof function instead of using the API method that checks for invalid pointers. This...

Astra Linux – Vulnerability in Firefox

In certain cases, SNI could be sent unencrypted even when encrypted DNS was enabled. This vulnerability was fixed in Firefox 139 and Thunderbird 139...

Astra Linux – Vulnerability in Firefox

Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148...

Astra Linux – Vulnerability in Firefox and Thunderbird

Use-after-free in the DOM: Bindings WebIDL component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...

Astra Linux – Vulnerability in Firefox, Thunderbird

An attacker could, through a specially crafted multipart response, execute arbitrary JavaScript under the resource://pdf.js origin. This would allow them to access PDF content from other origins. This access is limited to “same site” documents due to the Site Isolation feature on desktop clients,...

Astra Linux – Vulnerability in Firefox, Thunderbird

An attacker could, through a specially crafted multipart response, execute arbitrary JavaScript under the resource://devtools origin. This would allow them to access cross-origin JSON content. This access is limited to “same site” documents due to the Site Isolation feature on desktop clients, bu...

Astra Linux – Vulnerability in Firefox, Thunderbird

When creating a callback via IPC to display the Color Picker window, multiple identical callbacks might be created at once. Eventually, all of them would be destroyed as soon as one of the callbacks is completed. This could lead to a use-after-free condition, resulting in a potentially exploitabl...

Astra Linux – Vulnerability in Firefox, Thunderbird

Bypass of mitigation mechanisms in the File Handling component. This vulnerability has been fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10...