Astra Linux – Vulnerability in Firefox and Thunderbird

It was possible to cause the use of a MessagePort after it had already been freed, which could potentially lead to an exploitable crash. This vulnerability affects Firefox 120, Firefox ESR 115.5.0, and Thunderbird 115.5...

Astra Linux – Vulnerability in Firefox and Thunderbird

The black fade animation when exiting fullscreen is roughly the same duration as the delay in permission prompts during the anti-clickjacking process. It was possible to take advantage of this fact to surprise users by tempting them to click on the permission grant button before it appeared. This...

Astra Linux – Vulnerability in Firefox and Thunderbird

Due to a sequence of events controlled by the attacker, a JavaScript alert dialog with arbitrary although unstyled contents could be displayed over an uncontrolled web page of the attacker’s choice. This vulnerability affects Firefox 94, Thunderbird 91.3, and Firefox ESR 91.3...

Astra Linux – Vulnerability in Thunderbird

Information disclosure in the Widget: Cocoa component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...

Astra Linux – Vulnerability in Firefox and Thunderbird

A malicious web page could have caused a “use-after-free” issue, leading to memory corruption and potentially exploitable crashes. This bug can only be triggered when accessibility is enabled. This vulnerability affects Thunderbird 78.12, Firefox ESR 78.12, and Firefox 90...

Astra Linux – Vulnerability in Firefox and Thunderbird

Memory safety bugs exist in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability affects Firefox ESR...

Astra Linux – Vulnerability in Thunderbird

When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed, or both, Thunderbird may display incorrect encryption or signature statuses. After opening and viewing the attached message B, when returning to the display of message A, message A may...

Astra Linux – Vulnerability in Firefox and Thunderbird

Mozilla developers Andrew McCreight, Nicolas B. Pierron, and the Mozilla Fuzzing Team reported memory safety bugs in Firefox 100 and Firefox ESR 91.9. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited t...

Astra Linux – Vulnerability in Firefox and Thunderbird

When importing resources using Web Workers, error messages would distinguish the difference between application/javascript responses and non-script responses. This vulnerability could have been exploited to obtain information across origins. This issue affects Firefox versions earlier than 97,...

Astra Linux – Vulnerability in Firefox and Thunderbird

If a Blob URL is loaded through some unusual user interaction, it may have been loaded by the system principal, granting additional privileges that should not be granted to web content. This vulnerability affects Firefox ESR 78.10, Thunderbird 78.10, and Firefox 88...

Astra Linux – Vulnerability in Firefox and Thunderbird

When exiting fullscreen mode, an iframe could mislead the browser regarding the current state of fullscreen, potentially causing confusion for users or leading to spoofing attacks. This vulnerability affects Thunderbird 91.10, Firefox 101, and Firefox ESR 91.10...

Astra Linux – Vulnerability in Firefox and Thunderbird

Mozilla developers reported memory safety bugs in Firefox 90 and Firefox ESR 78.12. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability affects Thunderbird...

Astra Linux – Vulnerability in Firefox and Thunderbird

The Opportunistic Encryption feature of HTTP2 RFC 8164 allows a connection to be transparently upgraded to TLS while maintaining the visual properties of an HTTP connection. This means that the connection remains in the same origin as unencrypted connections on port 80. However, if a second...

Astra Linux – Vulnerability in Thunderbird

If a Thunderbird user has previously imported Alice’s OpenPGP key, and Alice has extended the validity period of her key, but Alice’s updated key has not yet been imported, an attacker may send an email containing a crafted version of Alice’s key with an invalid subkey. In this case, Thunderbird...

Astra Linux – Vulnerability in Thunderbird

If a MIME-encoded email contains an OpenPGP inline signed or encrypted message part, but also contains an additional unprotected part, Thunderbird did not indicate that only certain parts of the message are protected. This vulnerability affects Thunderbird versions earlier than 78.10.2...

Astra Linux – Vulnerability in Thunderbird

When an HTTPS page is embedded in an HTTP page, and a service worker is registered for the former, the service worker could intercept the request for the secure page. This occurs even though the iframe does not belong to a secure context due to the insecure framing. This vulnerability affects...

Astra Linux – Vulnerability in Thunderbird

Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments that can be hosted externally. When an email is opened, Thunderbird accesses the specified URL to determine the file size, and navigates to the attachment when the user clicks on it. Since the URL is not...

Astra Linux – Vulnerability in Firefox and Thunderbird

Memory safety bugs exist in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability affects Firefox...

Astra Linux – Vulnerabilities in Firefox, Thunderbird, NSS

An unchecked return value in the TLS handshake code could have caused a potentially exploitable crash. This vulnerability affects Firefox 122, Firefox ESR 115.9, and Thunderbird 115.9...

Astra Linux – Vulnerabilities in Firefox, Thunderbird, and Chromium

Before version 91.0.4472.101, using the "OUT OF BORD" write function in Google Chrome allowed a remote attacker to potentially perform out-of-bord memory access through a crafted HTML page...