Mozilla: Memory safety bugs fixed in Firefox 73 and Firefox ESR 68.5

Mozilla developers and community members reported memory safety bugs present in Firefox 72 and Firefox ESR 68.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. In general, these flaws...

The vulnerability of Firefox browsers, related to a network security service error called CertificateVerify, allows attackers to compromise data integrity.

The vulnerability of Firefox is related to a bug in the Network Security Service’s CertificateVerify function. Exploiting this vulnerability allows an attacker to compromise data integrity remotely...

The vulnerability of the FTP file transfer protocol in Firefox browsers allows a hacker to induce a service failure.

The vulnerability of the FTP file transfer protocol in Firefox browsers is related to resource management errors. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

The vulnerability of Firefox browser, related to the lack of protection for service data, allows attackers to gain access to confidential information.

The vulnerability of Firefox browsers is related to the lack of protection for service data. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data...

Vulnerability of the window.global component in the Firefox browser: This component allows a hacker to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the window.global component in the Firefox browser is related to an error in the Object.getOwnPropertyNameswindow method. This error allows for bypassing the isolated programming environment. Exploiting this vulnerability can enable a remote attacker to gain access to...

The vulnerability of the FTP file transfer protocol in Firefox browsers allows attackers to compromise data integrity.

The vulnerability of the FTP file transfer protocol in Firefox is related to an initialization error in the modal notification that can be triggered when the page is reloaded. Exploiting this vulnerability allows a remote attacker to compromise data integrity...

The vulnerability of Firefox browser, related to incorrect application installation when pressing the ALT + a keys on the keyboard, allows the attacker to compromise data integrity.

The vulnerability of Firefox browsers is related to the incorrect installation of extensions when pressing the ALT + a keys on the keyboard. This allows extensions to be installed without user confirmation. Exploiting this vulnerability can enable an attacker to compromise data integrity remotely...

The vulnerability of the Firefox browser’s WebRTC extension, which allows a perpetrator to compromise data integrity

The vulnerability of the Firefox browser’s WebRTC extension is related to a display-related error in the origin domain. Exploiting this vulnerability could allow an attacker to compromise the integrity of data...

The vulnerability of Firefox browser, related to the execution of operations beyond the buffer in memory, allows attackers to gain access to confidential data.

The vulnerability of the Firefox browser is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data...

The vulnerability of Firefox browser, related to an error in displaying the domain name in the address bar, allows attackers to compromise data integrity.

The vulnerability of Firefox browsers is related to an error in the display of the domain name in the address bar. Exploiting this vulnerability can allow a remote attacker to compromise the integrity of data...

The vulnerability of Firefox browser, related to the lack of protection for service data, allows attackers to gain access to confidential information.

The vulnerability of Firefox browsers is related to the lack of protection for service data. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data...

The vulnerability of Firefox browser, related to the lack of measures taken to protect the structure of web pages, allows attackers to compromise data integrity.

The vulnerability of Firefox browsers is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to compromise the integrity of data...

The vulnerability of the webcal resource identifier in the Firefox browser, related to the lack of protective measures for the website structure, allows attackers to compromise data integrity.

The vulnerability of the webcal resource identifier in the Firefox browser is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the data...

Mozilla Firefox 73 Browser Update Fixes High-Severity RCE Bugs

Mozilla has launched the latest version of its Firefox browser, which knocks out high-severity security flaws that leave systems open to attack by a remote adversary. The patched version of Mozilla’s browser, launched on Tuesday, is Firefox 73 and Firefox ESR 68.5. The Firefox ESR browser is its...

The vulnerability of the IonMonkey JIT-compiler for Firefox and Firefox ESR browsers lies in the access to resources through incompatible types. This allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the IonMonkey JavaScript compiler for Firefox and Firefox ESR browsers is related to a data type conversion error. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and even cause service interruptions through a...

Mozilla: CSS sanitization does not escape HTML tags

When pasting a style tag from the clipboard into a rich text editor, the CSS sanitizer does not escape and characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently...

Mozilla Firefox and Mozilla Firefox ESR Cross-Site Scripting Vulnerability (CNVD-2020-01175)

Mozilla Firefox and Mozilla Firefox ESR are both products of the Mozilla Foundation in the U.S. Mozilla Firefox is an open source web browser.Mozilla Firefox ESR is an extended support version of Firefox web browser. A cross-site scripting vulnerability exists in Mozilla Firefox ESR versions prio...

Mozilla Firefox and Mozilla Firefox ESR Memory Misreference Vulnerability (CNVD-2020-02150)

Mozilla Firefox and Mozilla Firefox ESR are both products of the Mozilla Foundation in the U.S. Mozilla Firefox is an open source web browser.Mozilla Firefox ESR is an extended support version of Firefox web browser. A security vulnerability exists in Mozilla Firefox version 71 and Mozilla Firefo...

Mozilla Firefox Security Bypass Vulnerability (CNVD-2020-02975)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox prior to version 72, which stems from the program not applying content security policies to the XSL stylesheets of XML documents. An attacker could us...

The vulnerability of Firefox browsers arises from the lack of a warning about mixed content when the favicon of a web page is loaded via HTTP. This allows attackers to perform spoofing attacks.

The vulnerability of Firefox browsers arises from the lack of a warning about mixed content when the favicon of a web page is loaded via HTTP. Exploiting this vulnerability allows a remote attacker to perform spoofing attacks...