1,955 results · Feed
-
Unscored —
Integer Overflow in RecordedSourceSurfaceCreation
On Windows, an integer overflow could occur in `RecordedSourceSurfaceCreation` which resulted in a heap buffer overflow potentially leaking sensitive data that could have led to a sandbox escape. *This bug only affects Firefox on Windows. Other operating syst…
-
Unscored —
Memory corruption in IPC FilePickerShownCallback
When creating a callback over IPC for showing the File Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished. This could have led to a use-after-fre…
-
Unscored —
Memory corruption in IPC ColorPickerShownCallback
When creating a callback over IPC for showing the Color Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished. This could have led to a use-after-fr…
-
Unscored —
Memory corruption in IPC CanvasTranslator
When receiving rendering data over IPC `mStream` could have been destroyed when initialized, which could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2,…
-
Unscored —
Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0. Some of these bugs showed evidence…
-
Unscored —
Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 10…
-
Unscored —
When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no …
-
Unscored —
When opening appref-ms files, Firefox did not warn the user that these files may contain malicious code. *This bug only…
-
Unscored —CVE-2023-4050 EPSS 13%
In some cases, an untrusted input stream was copied to a stack buffer without checking its size. This resulted in a pot…
-
Unscored —
Race conditions in reference counting code were found through code inspection. These could have resulted in potentially…
-
Unscored —
An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations.…
-
Unscored —
A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into grantin…
-
Unscored —
In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in …
-
Unscored —
Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from ano…
-
Unscored —
File Extension Spoofing using the Text Direction Override Character
Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in fact it was an executable file. Newer versions of Thunderbird will strip the character and show t…
-
Unscored —
Use-after-free in workers
During the worker lifecycle, a use-after-free condition could have occurred, which could have led to a potentially exploitable crash. This vulnerability affects Firefox < 115.0.2, Firefox ESR < 115.0.2, and Thunderbird < 115.0.1.
-
Unscored —
Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some of these bugs showed eviden…
-
Unscored —
When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code. This vulnerabili…
-
Unscored —
A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, …
-
Unscored —
Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in …
-
Unscored —
An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS. This vulnerab…
-
Medium 5.3CVE-2023-1999 Public exploit
Use after free in libwebp
There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encode…
-
Unscored —
Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these bugs showed eviden…
-
Unscored —
The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses to protect prompts…
-
Medium 6.5
If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and …
-
Medium 6.5
OCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certi…
-
High 8.8
An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 1…
-
High 8.8
Memory safety bugs present in Firefox 110 and Firefox ESR 102.8. Some of these bugs showed evidence of memory corruptio…
-
Medium 6.5
Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website…
-
High 8.8
While implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type. This could have…
-
Medium 6.5
Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable c…
-
Unscored —
An out-of-bound read could have led to a crash in the RLBox Expat driver. This vulnerability affects Firefox < 113, Fir…
-
Unscored —
In multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to pot…
-
Unscored —
An attacker could have positioned a `datalist` element to obscure the address bar. This vulnerability affects Firefox <…
-
High 8.8
A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permis…
-
Unscored —
Mozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian Hengst, Andrew McCr…
-
Unscored —
A type checking bug would have led to invalid code being compiled. This vulnerability affects Firefox < 113, Firefox ES…
-
Unscored —
When reading a file, an uninitialized value could have been used as read limit. This vulnerability affects Firefox < 11…
-
Unscored —
Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resu…
-
Medium 6.5
A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affe…