Open Source Vulnerabilities

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Lack of correct bounds checking in Skia in Google Chrome prior to 73

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user's...

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

vulnerability exists in the Windows sandbox where an uninitialized value in memory can be leaked to a renderer from a broker when making a call to access an otherwise unavailable file

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a c...

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

png_image_free in png

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

race condition is present in the crash generation server used to generate data for the crash reporter

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Images from a different domain can be read using a canvas object in some circumstances

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

If hyperthreading is not disabled, a timing attack vulnerability exists, similar to previous Spectre attacks

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromi...

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that used the compromised translation

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same directory or sub-directories if the names are known or guessed

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being used as a separator, allowing for possible spoofing of origin attributes

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Due to an error while parsing page content, it is possible for properly sanitized user input to be misinterpreted and lead to XSS hazards on web sites in certain circumstances

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

use-after-free vulnerability can occur in HTTP/2 when a cached HTTP/2 stream is closed while still in use, resulting in a potentially exploitable crash

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS requirements

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When an inner window is reused, it does not consider the use of document

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

use-after-free vulnerability can occur while manipulating video elements if the body is freed while still in use

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Some HTML elements, such as <title> and <textarea>, can contain literal angle brackets without treating them as markup

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Navigation events were not fully adhering to the W3C's "Navigation-Timing Level 2" draft specification in some instances for the unload event, which restricts access to detailed timing attributes t...

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a <canvas> element due to an error in how same-origin policy is applied ...

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Mozilla developers and community members reported memory safety bugs present in Firefox 68, Firefox ESR 68, and Firefox 60

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Given a compromised sandboxed content process due to a separate vulnerability, it is possible to escape that sandbox by loading accounts

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security was installed

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Mozilla developers reported memory safety bugs present in Firefox 70 and Firefox ESR 68

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could cause a use-after-free condition and a potentially exploitable crash

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have caused a use-after-free and a potentially exploitable crash

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to locate and exploit a vulnerability in file handling in the ...

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When using nested workers, a use-after-free could occur during worker destruction

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

plain text serializer used a fixed-size array for the number of <ol> elements it could process; however it was possible to overflow the static-sized array leading to memory corruption and a potenti...

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Mozilla developers and community members reported memory safety bugs present in Firefox 72 and Firefox ESR 68

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Command line arguments could have been injected during Firefox invocation as a shell handler for certain unsupported file types

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

If a template tag was used in a select tag, the parser could be confused and allow JavaScript parsing and execution when it should not be allowed

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

By downloading a file with the

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

content process could have modified shared memory relating to crash reporting information, crash itself, and cause an out-of-bound write

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog

firefox, firefox, firefox, firefox, firefox

If upgrade-insecure-requests was specified in the Content Security Policy, and a link was dragged and dropped from that page, the link was not upgraded to https

firefox, firefox, firefox, firefox, firefox

Content-Security-Policy that blocks in-line scripts could be bypassed using an object tag to execute JavaScript in the protected document (cross-site scripting)