CVE-2023-23598

Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged a website could arbitrarily read a file via a call to DataTransfer.setData. This vulnerability affects Firefox 109, Firefox ESR 102.7, and Thunderbird...

CVE-2023-25729

Permission prompts for opening external schemes were only shown for ContentPrincipals resulting in extensions being able to open them without user interaction via ExpandedPrincipals. This could lead to further malicious actions such as downloading files or interacting with software already...

CVE-2023-25738

Members of the DEVMODEW struct set by the printer device driver weren't being validated and could have resulted in invalid values which in turn would cause the browser to attempt out of bounds access to related variables.This bug only affects Firefox on Windows. Other operating systems are...

CVE-2023-29539

When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware. This vulnerability affects Firefox 112, Focus f...

CVE-2023-29548

A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affects Firefox 112, Focus for Android 112, Firefox ESR 102.10, Firefox for Android 112, and Thunderbird 102.10...

CVE-2023-1945

Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird 102.10 and Firefox ESR 102.10...

CVE-2023-23601

Navigations were being allowed when dragging a URL from a cross-origin iframe into the same tab which could lead to website spoofing attacks This vulnerability affects Firefox 109, Firefox ESR 102.7, and Thunderbird 102.7...

CVE-2023-29533

A website could have obscured the fullscreen notification by using a combination of window.open, fullscreen requests, window.name assignments, and setInterval calls. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox 112, Focus for Android 112,...

CVE-2023-25746

Memory safety bugs present in Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird 102.8 and Firefox ESR 102.8...

The vulnerability of Firefox and Firefox ESR browsers stems from the absence of a delay in pop-up notifications, which allows attackers to gain unauthorized access to certain browser functions.

The vulnerability of Firefox and Firefox ESR browsers exists due to the absence of a delay in pop-up notifications. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to certain functions of the browser...

The vulnerability of Firefox and Firefox ESR browsers relates to deficiencies in access control for certain functions, allowing attackers to trigger the loading of documents with higher privileges.

The vulnerability of Firefox and Firefox ESR browsers is related to deficiencies in access control for certain functions. Exploiting this vulnerability allows a malicious actor to trigger the loading of documents with higher privileges from a remote location...

The vulnerabilities of Mozilla Firefox, Focus for Android, Mozilla Firefox ESR, and the email client Thunderbird involve improper handling of file names that end with .desktop. This allows attackers to bypass security restrictions and execute arbitrary commands.

The vulnerability in Mozilla Firefox, Focus for Android, Mozilla Firefox ESR, and the email client Thunderbird is related to incorrect handling of file names that end with .desktop. Exploiting this vulnerability allows a remote attacker to bypass security restrictions and execute arbitrary comman...

The vulnerabilities of Mozilla Firefox, Focus for Android, Mozilla Firefox ESR, and the email client Thunderbird are related to improper processing of the Content-Disposition header directive. This allows attackers to bypass security restrictions and download arbitrary files.

The vulnerabilities of Mozilla Firefox, Focus for Android, Mozilla Firefox ESR, and the email client Thunderbird are related to improper processing of the Content-Disposition header directive. Exploiting these vulnerabilities allows a remote attacker to bypass security restrictions and download...

The vulnerabilities of Mozilla Firefox, Focus for Android, Mozilla Firefox ESR, and the email client Thunderbird involve allowing an unauthorized pointer to be freed, enabling a hacker to execute arbitrary code or cause a service failure.

The vulnerabilities of Mozilla Firefox, Focus for Android, Mozilla Firefox ESR, and the email client Thunderbird are related to the exploitation of an invalid pointer. Exploiting these vulnerabilities allows a remote attacker to execute arbitrary code or cause service interruptions...

The vulnerability in the Mozilla Maintenance service affects browsers such as Mozilla Firefox, Focus for Android, Mozilla Firefox ESR, and the email client Thunderbird. This vulnerability allows an attacker to gain access to read, modify, or delete data.

The vulnerability in the Mozilla Maintenance service affects the Mozilla Firefox browser, Focus for Android, Mozilla Firefox ESR, and the email client Thunderbird. It relates to deficiencies in access control during the verification of update signatures. Exploiting this vulnerability could allow ...

AlmaLinux 9 : thunderbird (ALSA-2023:3150)

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2023:3150 advisory. - In multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to potential user confusion and spoofin...

Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11

The Mozilla Foundation Security Advisory describes this flaw as: Mozilla developers and community members reported memory safety bugs present in Firefox 112 and Firefox ESR 102.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could...

Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11

The Mozilla Foundation Security Advisory describes this flaw as: Mozilla developers and community members reported memory safety bugs present in Firefox 112 and Firefox ESR 102.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could...

Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11

The Mozilla Foundation Security Advisory describes this flaw as: Mozilla developers and community members reported memory safety bugs present in Firefox 112 and Firefox ESR 102.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could...

Mozilla: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11

The Mozilla Foundation Security Advisory describes this flaw as: Mozilla developers and community members reported memory safety bugs present in Firefox 112 and Firefox ESR 102.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could...