Astra Linux – Vulnerability in Firefox and Thunderbird

Ports that were written as integer overflows above the bounds of a 16-bit integer could potentially bypass port blocking restrictions when used in the Alt-Svc header. This vulnerability affects Firefox ESR 78.10, Thunderbird 78.10, and Firefox 88...

Astra Linux – Vulnerability in Firefox and Thunderbird

When receiving rendering data via IPC mStream, it might have been destroyed during initialization, which could lead to a use-after-free condition and potentially cause a crash. This vulnerability affects Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2...

Astra Linux – Vulnerability in Firefox and Thunderbird

Excel .xll add-ins did not have a blocklist entry in Firefox’s executable blocklist, which allowed them to be downloaded without any warning of their potential harm. This vulnerability affects Firefox 117, Firefox ESR 102.15, Firefox ESR 115.2, Thunderbird 102.15, and Thunderbird 115.2...

Astra Linux – Vulnerability in Firefox and Thunderbird

When creating a callback via IPC to display the Color Picker window, multiple identical callbacks might be created at once. Eventually, all of them would be destroyed as soon as one of the callbacks is completed. This could lead to a use-after-free condition, resulting in a potentially exploitabl...

Astra Linux – Vulnerability in Firefox and Thunderbird

When creating a callback via IPC to display the File Picker window, multiple identical callbacks might be created at once. Eventually, all of them would be destroyed as soon as one of the callbacks is completed. This could lead to a use-after-free condition, resulting in a potentially exploitable...

Astra Linux – Vulnerability in Firefox and Thunderbird

A website could have obscured the fullscreen notification by using a dropdown select input element. This could have caused user confusion and potentially led to spoofing attacks. This vulnerability affects Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8...

Astra Linux – Vulnerability in Firefox and Thunderbird

Through a series of API calls and redirections, an alert dialog controlled by an attacker could have been displayed on another website with the victim website’s URL shown. This vulnerability affects Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8...

Astra Linux – Vulnerability in Firefox and Thunderbird

If a website sets a large custom cursor, portions of the cursor may overlap with the permission dialog, potentially causing confusion for users and leading to unexpected granting of permissions. This vulnerability affects Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8...

Astra Linux – Vulnerability in Thunderbird, Firefox

Due to the Firefox GTK wrapper code using text/plain for drag data, and GTK treating all text/plain MIME types that contain file URLs as being dragged, a website can arbitrarily read a file by calling DataTransfer.setData. This vulnerability affects Firefox 109, Firefox ESR 102.7, and Thunderbird...

Astra Linux – Vulnerability in Firefox and Thunderbird

When a parent page loaded a child in an iframe with unsafe-inline, the parent Content Security Policy could override the child Content Security Policy. This vulnerability affects Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7...

Astra Linux – Vulnerability in Firefox and Thunderbird

An improper implementation of the new iframe sandbox keyword allow-top-navigation-by-user-activation could allow script execution when the allow-scripts flag is not set. This vulnerability affects Thunderbird version 91.9, Firefox ESR version 91.9, and Firefox version 100...

Astra Linux – Vulnerability in Firefox and Thunderbird

A bug in the calculation of popup notification delays could have allowed an attacker to trick a user into granting permissions. This vulnerability affects Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7...

Astra Linux – Vulnerability in Thunderbird

Use-after-free in the Widget: Cocoa component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...

Astra Linux – Vulnerability in Firefox and Thunderbird

When accessing directory listings for chrome:// URLs as source text, certain parameters are reflected. This vulnerability affects Firefox ESR 102.1, Firefox ESR 91.12, Firefox 103, Thunderbird 102.1, and Thunderbird 91.12...

Astra Linux – Vulnerability in Firefox and Thunderbird

A missing delay in the timing of the pointer lock mechanism could have allowed a malicious page to trick users into granting permissions. This vulnerability affects Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9...

Astra Linux – Vulnerability in Firefox and Thunderbird

If an attacker could find a way to trigger a specific code path in SafeRefPtr, it could cause a crash or potentially be used to execute malicious code. This vulnerability affects Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9...

Astra Linux – Vulnerability in Thunderbird

After a VR process is destroyed, a reference to it may have been retained and used, leading to a “use-after-free” issue and potentially exploitable crashes. This vulnerability affects Thunderbird 91.8 and Firefox ESR 91.8...

Astra Linux – Vulnerability in Firefox and Thunderbird

Mozilla developers reported memory safety bugs in Firefox 88 and Firefox ESR 78.11. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability affects Thunderbird...

Astra Linux – Vulnerability in Firefox and Thunderbird

Memory safety bugs exist in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability affects Firefox ESR...

Astra Linux – Vulnerability in Thunderbird

A data race could occur in the PK11ChangePW function, potentially leading to a use-after-free vulnerability. In Firefox, this lock protected the data when a user changed their master password. This vulnerability affects Firefox ESR 102.2 and Thunderbird 102.2...