Debian DSA-4959-1 : thunderbird - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-4959 advisory. Multiple security issues were discovered in Thunderbird, which could result in the execution of arbitrary code. For the stable distribution bullseye, these proble...

Updated firefox packages fix security vulnerabilities

Updated firefox packages fix security vulnerabilities: Uninitialized memory in a canvas object could have caused an incorrect free leading to memory corruption and a potentially exploitable crash CVE-2021-29980. Instruction reordering during JIT optimization resulted in a sequence of instructions...

SUSE SLES11: MozillaFirefox / MozillaFirefox-translations-common / etc (SUSE-SU-2021:14782-1)

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:14782-1 advisory. Firefox Extended Support Release 78.13.0 ESR MFSA 2021-34, bsc1188891: - CVE-2021-29986: Race condition when resolving DNS names could have le...

Debian DLA-2740-1 : firefox-esr - LTS security update

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2740 advisory. - Mozilla developers reported memory safety bugs present in Firefox 90 and Firefox ESR 78.12. Some of these bugs showed evidence of memory corruption and we presum...

Denial Of Service(DoS)

firefox-esr:edge is vulnerable to denial of service. A use-after-free vulnerability in media channels could have led to memory corruption and a potentially exploitable crash...

CVE-2021-29980

Uninitialized memory in a canvas object could have caused an incorrect free leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird 78.13, Thunderbird 91, Firefox ESR 78.13, and Firefox 91...

Mozilla Firefox ESR < 78.13

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 78.13. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-34 advisory. - Mozilla developers Christoph Kerschbaumer, Simon Giesecke, Sandor Molnar, and Olli Pettay reported memor...

Security Vulnerabilities fixed in Thunderbird 78.13 — Mozilla

A suspected race condition when calling getaddrinfo led to memory corruption and a potentially exploitable crash. Note: This issue only affected Linux operating systems. Other operating systems are unaffected. Thunderbird incorrectly treated an inline list-item element as a block element, resulti...

Mozilla Firefox < 91.0

The version of Firefox installed on the remote Windows host is prior to 91.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-33 advisory. - Mozilla developers and community members Kershaw Chang, Philipp, Chris Peterson, and Sebastian Hengst reported memory...

Mozilla Firefox ESR < 78.13

The version of Firefox ESR installed on the remote Windows host is prior to 78.13. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-34 advisory. - Mozilla developers Christoph Kerschbaumer, Simon Giesecke, Sandor Molnar, and Olli Pettay reported memory safety...

Memory corruption

A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially exploitable crash. This bug could only be triggered when accessibility was enabled.. This vulnerability affects Thunderbird 78.12, Firefox ESR 78.12, and Firefox 90...

Denial Of Service

firefox is vulnerable to denial of service. The vulnerability exists due to a use-after-free, memory corruption, and a potentially exploitable crash...

CVE-2021-29970

A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially exploitable crash. This bug could only be triggered when accessibility was enabled.. This vulnerability affects Thunderbird 78.12, Firefox ESR 78.12, and Firefox 90...

Security Vulnerabilities fixed in Thunderbird 78.12 — Mozilla

If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses prior to the completion of the STARTTLS handshake, then Thunderbird didn't ignore the injected data. This could have resulted in Thunderbird showing incorrect information, for...

Security Vulnerabilities fixed in Firefox ESR 78.12 — Mozilla

A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially exploitable crash. This bug only affected Firefox when accessibility was enabled. An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable...

Mozilla Thunderbird < 78.12

The version of Thunderbird installed on the remote Windows host is prior to 78.12. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-30 advisory. - An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially...

Mozilla Firefox ESR < 78.12

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 78.12. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-29 advisory. - An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentiall...

CVE-2021-23983

By causing a transition on a parent node by removing a CSS rule, an invalid property for a marker could have been applied, resulting in memory corruption and a potentially exploitable crash. This vulnerability affects Firefox 87...

NewStart CGSL MAIN 6.02 : thunderbird Multiple Vulnerabilities (NS-SA-2021-0056)

The remote NewStart CGSL host, running version MAIN 6.02, has thunderbird packages installed that are affected by multiple vulnerabilities: - Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memory corruption and a potentially...

CVE-2020-26972

The lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former must ensure that they are not attempting to use a dead actor they have a reference to. Such a check was omitted in WebGL, resulting in a use-after-free and a potentially exploitable crash. This...