Astra Linux – Vulnerability in Firefox and Thunderbird

Set-Cookie response headers were being honored incorrectly in multipart HTTP responses. If an attacker could control the Content-Type response header, as well as part of the response body, they could inject Set-Cookie headers that would be honored by the browser. This vulnerability affects Firefo...

Astra Linux – Vulnerability in Thunderbird

Ribose RNP before version 0.16.3 may hang when the input is malformed...

Astra Linux – Vulnerability in Firefox and Thunderbird

In some cases, an untrusted input stream was copied to a stack buffer without checking its size. This resulted in a potentially exploitable crash, which could have led to a sandbox escape. This vulnerability affects Firefox 116, Firefox ESR 102.14, and Firefox ESR 115.1...

Astra Linux – Vulnerability in Firefox and Thunderbird

Module load requests that failed were not checked to determine whether they had been cancelled, resulting in a use-after-free in ScriptLoadContext. This vulnerability affects Firefox 110, Thunderbird 102.8, and Firefox ESR 102.8...

Astra Linux – Vulnerability in Firefox and Thunderbird

Permission prompts for opening external schemes were only displayed for ContentPrincipals, allowing extensions to open them without user interaction through ExpandedPrincipals. This could lead to further malicious actions, such as downloading files or interacting with software already installed o...

Astra Linux – Vulnerability in Firefox and Thunderbird

The Content-Security-Policy-Report-Only header could allow an attacker to leak the unredacted URI of a child iframe when interaction with that iframe triggers a redirect. This vulnerability affects Firefox 110, Thunderbird 102.8, and Firefox ESR 102.8...

Astra Linux – Vulnerability in Firefox and Thunderbird

Push notifications stored on disk in private browsing mode were not encrypted, potentially allowing the leakage of sensitive information. This vulnerability affects Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2...

Astra Linux – Vulnerability in Firefox and Thunderbird

Excel .xll add-ins did not have a blocklist entry in Firefox’s executable blocklist, which allowed them to be downloaded without any warning of their potential harm. This vulnerability affects Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2...

Astra Linux – Vulnerability in Firefox and Thunderbird

During Ion compilation, a garbage collection operation could lead to a “use-after-free” condition, allowing an attacker to write two NUL bytes and cause a potentially exploitable crash. This vulnerability affects Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3...

Astra Linux – Vulnerability in Thunderbird

An attacker could create a malicious link that uses bidirectional characters to spoof the location in the address bar when visited. This vulnerability affects Firefox 117, Firefox ESR 115.4, and Thunderbird 115.4.1...

Astra Linux – Vulnerability in Firefox and Thunderbird

When handling keypress events, an attacker might have been able to trick a user into bypassing the “Open Executable File?” confirmation dialog. This could have led to the execution of malicious code. This vulnerability affects Firefox 133, Firefox ESR 128.5, Thunderbird 133, and Thunderbird 128.5...

Astra Linux – Vulnerability in Firefox and Thunderbird

Memory safety bugs exist in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability affects Firefox version...

Astra Linux – Vulnerability in Firefox

Missing thread synchronization primitives could have led to a data race on members of the PlaybackParams structure. This vulnerability affects Firefox 133 and Thunderbird 133...

Astra Linux – Vulnerability in Firefox

In certain cases, SNI could be sent unencrypted even when encrypted DNS was enabled. This vulnerability was fixed in Firefox 139 and Thunderbird 139...

Astra Linux – Vulnerability in Thunderbird

A double-free might have occurred in vpxcodecencinitmulti after a failed allocation during the initialization of the encoder for WebRTC. This could have caused memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird versions 139 and Thunderbird versions 128.1...

Astra Linux – Vulnerability in Firefox

Previewing a response in Devtools ignored CSP headers, which could have allowed content injection attacks. This vulnerability was fixed in Firefox 139 and Thunderbird 139...

Astra Linux – Vulnerability in Firefox

Memory safety bugs exist in Firefox 138 and Thunderbird 138. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability has been fixed in Firefox 139 and Thunderbird...

Astra Linux – Vulnerability in Firefox

When Multi-Account Containers was enabled, DNS requests could bypass a SOCKS proxy when the domain name was invalid or the SOCKS proxy was not responding. This vulnerability was fixed in Firefox 140 and Thunderbird 140...

Astra Linux – Vulnerability in Firefox and Thunderbird

Mozilla developers and community members reported memory safety bugs in Firefox 86 and Firefox ESR 78.8. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability...

Astra Linux – Vulnerability in Firefox and Thunderbird

Through complicated navigation with new windows, an HTTP page could inherit a secure lock icon from an HTTPS page. This vulnerability affects Firefox ESR 78.10, Thunderbird 78.10, and Firefox 88...