Mozilla -- memory safety bugs

[email protected] reports: Memory safety bugs present in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort som...

Linux Distros Unpatched Vulnerability : CVE-2022-31738

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user confusion or spoofing...

Linux Distros Unpatched Vulnerability : CVE-2023-6211

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - If an attacker needed a user to load an insecure http: page and knew that user had enabled HTTPS-only mode, the attacker could have tricked the user into clicki...

Linux Distros Unpatched Vulnerability : CVE-2023-32210

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Documents were incorrectly assuming an ordering of principal objects when ensuring we were loading an appropriately privileged principal. In certain circumstanc...

Linux Distros Unpatched Vulnerability : CVE-2017-7831

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability where the security wrapper does not deny access to some exposed properties using the deprecated exposedProps mechanism on proxy objects. These...

Linux Distros Unpatched Vulnerability : CVE-2023-23601

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Navigations were being allowed when dragging a URL from a cross-origin iframe into the same tab which could lead to website spoofing attacks This vulnerability...

Linux Distros Unpatched Vulnerability : CVE-2021-43539

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Failure to correctly record the location of live pointers across wasm instance calls resulted in a GC occurring within the call not tracing those live pointers...

Linux Distros Unpatched Vulnerability : CVE-2019-9805

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A latent vulnerability exists in the Prio library where data may be read from uninitialized memory for some functions, leading to potential memory corruption...

Linux Distros Unpatched Vulnerability : CVE-2023-6209

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal /../ part in the path could be used to override the specified host. This...

Linux Distros Unpatched Vulnerability : CVE-2022-46871

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out of date library libusrsctp contained vulnerabilities that could potentially be exploited. This vulnerability affects Firefox 108. CVE-2022-46871 Note tha...

Linux Distros Unpatched Vulnerability : CVE-2025-3035

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - By first using the AI chatbot in one tab and later activating it in another tab, the document title of the previous tab would leak into the chat prompt. This...

Linux Distros Unpatched Vulnerability : CVE-2021-23974

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The DOMParser API did not properly process '' elements for escaping. This could be used as an mXSS vector to bypass an HTML Sanitizer. This vulnerability affect...

Linux Distros Unpatched Vulnerability : CVE-2023-32212

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker could have positioned a datalist element to obscure the address bar. This vulnerability affects Firefox 113, Firefox ESR 102.11, and Thunderbird...

[SECURITY] Fedora 41 Update: firefox-141.0.2-1.fc41

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

Linux Distros Unpatched Vulnerability : CVE-2023-28177

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory safety bugs present in Firefox 110. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could ha...

Linux Distros Unpatched Vulnerability : CVE-2025-6436

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory safety bugs present in Firefox 139 and Thunderbird 139. Some of these bugs showed evidence of memory corruption and we presume that with enough effort so...

Linux Distros Unpatched Vulnerability : CVE-2017-7798

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Developer Tools feature suffers from a XUL injection vulnerability due to improper sanitization of the web page source code. In the worst case, this could...

[SECURITY] Fedora 42 Update: firefox-141.0.2-1.fc42

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

Linux Distros Unpatched Vulnerability : CVE-2022-31748

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mozilla developers Gabriele Svelto, Timothy Nikkel, Randell Jesup, Jon Coppeard, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 100...

Linux Distros Unpatched Vulnerability : CVE-2023-6859

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free condition affected TLS socket creation when under memory pressure. This vulnerability affects Firefox ESR 115.6, Thunderbird 115.6, and Firefox...