64 results · Clear filters · Feed
-
Critical 9.8
Disclosure of uninitialized memory when .toUpperCase() causes string to get longer
When String.toUpperCase() caused a string to get longer it was possible for uninitialized memory to be incorporated into the result string. This vulnerability was fixed in Firefox 136 and Thunderbird 136.
-
Critical 9.8
Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7
Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.…
-
Critical 9.8
Memory safety bugs fixed in Firefox 135 and Thunderbird 135
Memory safety bugs present in Firefox 134 and Thunderbird 134. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefo…
-
Critical 9.8
Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20, and Thunderbird 128.7
Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could ha…
-
Critical 9.8
Use-after-free during concurrent delazification
A race during concurrent delazification could have led to a use-after-free. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
-
Critical 9.8
A bug in WebAssembly code generation could result in a crash
A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code execution. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
-
Critical 9.8
Use-after-free in Custom Highlight
An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
-
Critical 9.8
Use-after-free in XSLT
An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
-
Critical 9.8CVE-2025-0247 EPSS 11%
Memory safety bugs fixed in Firefox 134 and Thunderbird 134
Memory safety bugs present in Firefox 133 and Thunderbird 133. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefo…
-
Critical 9.1
`NSC_DeriveKey` inadvertently assumed that the `phKey` parameter is always non-NULL. When it was passed as NULL, a segm…
-
Critical 9.8
A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path. Under speci…
-
Critical 9.8
Potential race conditions in IndexedDB could have caused memory corruption, leading to a potentially exploitable crash.…
-
Critical 9.8
Memory safety bugs present in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3. Some of these bugs showed evidence…
-
Critical 9.8
An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timel…
KEV Oct 15, 2024 -
Critical 9.8
Memory safety bugs present in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 128.2. Some of these …
-
Critical 9.8
Memory safety bugs present in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs showed evidence…
-
Critical 9.8
A compromised content process could have allowed for the arbitrary loading of cross-origin pages. This vulnerability af…
-
Critical 9.8
Memory safety bugs present in Firefox 129. Some of these bugs showed evidence of memory corruption and we presume that …
-
Critical 9.8
Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1. Some of these bugs showed evidence…
-
Critical 9.8
A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an exploitable type confus…
-
Critical 9.8
The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected at the right…
-
Critical 9.8CVE-2024-8381 Public exploit
A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as …
-
Critical 9.8
Incorrect garbage collection interaction could have led to a use-after-free. This vulnerability affects Firefox < 129.
-
Critical 9.8
Incorrect garbage collection interaction in IndexedDB could have led to a use-after-free. This vulnerability affects Fi…
-
Critical 9.1
It was possible for a web extension with minimal permissions to create a `StreamFilter` which could be used to read and…
-
Critical 9.1
Editor code failed to check an attribute value. This could have led to an out-of-bounds read. This vulnerability affect…
-
Critical 9.8
Incomplete WebAssembly exception handing could have led to a use-after-free. This vulnerability affects Firefox < 129, …
-
Critical 9.8
Incorrect handling of SameSite cookies
A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies. This vulnerability affects Firefox < 128 and Thunderbird < 128.
-
Critical 9.8
Memory corruption in NSS
A mismatch between allocator and deallocator could have led to memory corruption. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.
-
Critical 9.8
Memory safety bugs present in Firefox 126. Some of these bugs showed evidence of memory corruption and we presume that …
-
Critical 9.8
In violation of spec, cookie prefixes such as `__Secure` were being ignored if they were not correctly capitalized - by…
-
Critical 9.8
If an out-of-memory condition occurs at a specific point using allocations in the probabilistic heap checker, an assert…
-
Critical 9.8
Memory safety bugs present in Firefox 125. Some of these bugs showed evidence of memory corruption and we presume that …
-
Critical 9.8
Multiple WebRTC threads could have claimed a newly connected audio input leading to use-after-free. This vulnerability …
-
Critical 9.8
An attacker was able to perform an out-of-bounds read or write on a JavaScript object by fooling range-based bounds che…
-
Critical 9.8
Memory safety bugs present in Firefox 123. Some of these bugs showed evidence of memory corruption and we presume that …
-
Critical 9.8
The `fetch()` API and navigation incorrectly shared the same cache, as the cache key did not include the optional heade…
-
Critical 9.8
During process shutdown, it was possible that an `ImageBitmap` was created that would later be used after being freed f…
-
Critical 9.8
A hashtable in the Ion Engine could have been mutated while there was a live interior reference, leading to a potential…
-
Critical 9.8
Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence…