Open Source Vulnerabilities

knative-operator-1.24

HotCRP: comment-author search exposes anonymous commenter identities

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When processing callbacks that occurred during window flushing in the parent process, the associated window may die; causing a use-after-free condition

firefox, firefox, firefox, firefox, firefox

VideoStreamEncoder may have been freed in a race condition with VideoBroadcaster::AddOrUpdateSink, resulting in a use-after-free, memory corruption, and a potentially exploitable crash

firefox, firefox, firefox, firefox, firefox

When "%2F" was present in a manifest URL, Firefox's AppCache behavior may have become confused and allowed a manifest to be served from a subdirectory

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memory corruption and a potentially exploitable crash

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Inappropriate implementation in WebRTC in Google Chrome prior to 84

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Use after free in ANGLE in Google Chrome prior to 81

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Mozilla developers and community members reported memory safety bugs present in Firefox 78 and Firefox ESR 78

firefox, firefox, firefox, firefox, firefox

lock was missing when accessing a data structure and importing certificate information into the trust database

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

code for downloading files did not properly take care of special characters, which led to an attacker being able to cut off the file ending at an earlier position, leading to a different file type ...

firefox, firefox, firefox, firefox, firefox

When processing a MAR update file, after the signature has been validated, an invalid name length could result in a heap overflow, leading to memory corruption and potentially arbitrary code execution

firefox, firefox, firefox, firefox, firefox

When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500, 412, 403, etc

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Firefox could be made to load attacker-supplied DLL files from the installation directory

firefox, firefox, firefox, firefox, firefox

Firefox did not reset the address bar after the beforeunload dialog was shown if the user chose to remain on the page

OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

JIT optimizations involving the Javascript arguments object could confuse later optimizations

firefox, firefox, firefox, firefox, firefox

During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent on secret data

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

redirected HTTP request which is observed or modified through a web extension could bypass existing CORS checks, leading to potential disclosure of cross-origin information

firefox, firefox, firefox, firefox, firefox

When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side channel attack

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interface, when they are not

firefox, firefox, firefox, firefox, firefox

When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which leaked partial information about the nonce used during signature generation

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

iframe sandbox element with the allow-popups flag could be bypassed when using noopener links

firefox, firefox, firefox, firefox, firefox

When processing surfaces, the lifetime may outlive a persistent buffer leading to memory corruption and a potentially exploitable crash

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect

firefox, firefox, firefox, firefox, firefox

Mozilla developers reported memory safety bugs present in Firefox 80

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Mozilla developers reported memory safety bugs present in Firefox for Android 79

firefox, firefox, firefox, firefox, firefox

Mozilla developers reported memory safety bugs present in Firefox 81

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would allow them to prompt the user to inst...

firefox, firefox, firefox, firefox, firefox

When a link to an external protocol was clicked, a prompt was presented that allowed the user to choose what application to open it in

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater

firefox, firefox, firefox, firefox, firefox

When multiple WASM threads had a reference to a module, and were looking up exported functions, one WASM thread could have overwritten another's entry in a shared stub table, resulting in a potenti...

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free

firefox, firefox, firefox, firefox, firefox

If a valid external protocol handler was referenced in an image tag, the resulting broken image size could be distinguished from a broken image size of a non-existent protocol handler

firefox, firefox, firefox, firefox, firefox

Crossbeam is a set of tools for concurrent programming

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original site (the one suffering from the open r...

firefox, firefox, firefox, firefox, firefox

Mozilla developers reported memory safety bugs present in Firefox 82

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attacker-controlled data into a contentedita...

firefox, firefox, firefox, firefox, firefox

When listening for page changes with a Mutation Observer, a malicious web page could confuse Firefox Screenshots into interacting with elements other than those that it injected into the page

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78

firefox, firefox, firefox, firefox, firefox

If the Remote Debugging via USB feature was enabled in Firefox for Android on an Android version prior to Android 6

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78

firefox, firefox, firefox, firefox, firefox

Repeated calls to the history and location interfaces could have been used to hang the browser

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Searching for a single word from the address bar caused an mDNS request to be sent on the local network searching for a hostname consisting of that string; resulting in an information leak

firefox, firefox, firefox, firefox, firefox

Cross-origin iframes that contained a login form could have been recognized by the login autofill service, and populated

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field, revealing the typed password

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses as these do not make sense coming from a DoH resolver

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

If the Compact() method was called on an nsTArray, the array could have been reallocated without updating other pointers, leading to a potential use-after-free and exploitable crash

firefox, firefox, firefox, firefox, firefox

OneCRL was non-functional in the new Firefox for Android due to a missing service initialization