Open Source Vulnerabilities

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When Firefox is configured to block storage of all cookies, it was still possible to store data in localstorage by using an iframe with a source of 'about:blank'

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

During the worker lifecycle, a use-after-free condition could have occurred, which could have led to a potentially exploitable crash

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Memory safety bugs present in Firefox 115, Firefox ESR 115

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Memory safety bugs present in Firefox 115, Firefox ESR 115

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When the number of cookies per domain was exceeded in `document

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When opening appref-ms files, Firefox did not warn the user that these files may contain malicious code

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Firefox updater created a directory writable by non-privileged users

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

In some cases, an untrusted input stream was copied to a stack buffer without checking its size

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Race conditions in reference counting code were found through code inspection

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from another site in violation of same-origin policy

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Memory safety bugs present in Firefox 116, Firefox ESR 115

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Memory safety bugs present in Firefox 116, Firefox ESR 102

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When checking if the Browsing Context had been discarded in `HttpBaseChannel`, if the load group was not available then it was assumed to have already been discarded which was not always the case f...

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Due to large allocation checks in Angle for glsl shaders being too lenient a buffer overflow could have occurred when allocating too much private shader memory on mac OS

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Excel `

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Push notifications stored on disk in private browsing mode were not being encrypted potentially allowing the leak of sensitive information

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

website could have obscured the full screen notification by using a URL with a scheme handled by an external program, such as a mailto URL

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When calling `JS::CheckRegExpSyntax` a Syntax Error could have been set which would end in calling `convertToRuntimeErrorAndClear`

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

website could have obscured the full screen notification by using the file open dialog

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When `UpdateRegExpStatics` attempted to access `initialStringHeap` it could already have been garbage collected prior to entering the function, which could potentially have led to an exploitable crash

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

On Windows, an integer overflow could occur in `RecordedSourceSurfaceCreation` which resulted in a heap buffer overflow potentially leaking sensitive data that could have led to a sandbox escape

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When creating a callback over IPC for showing the File Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of ...

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When creating a callback over IPC for showing the Color Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of...

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When receiving rendering data over IPC `mStream` could have been destroyed when initialized, which could have led to a use-after-free causing a potentially exploitable crash

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Memory safety bugs present in Firefox 117, Firefox ESR 115

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointer twice, resulting in a use-after-free and a potentially exploitable crash

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing an attacker to write two NUL bytes, and cause a potentially exploitable crash

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

compromised content process could have provided malicious data in a `PathRecording` resulting in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

compromised content process could have provided malicious data to `FilterNodeD2D1` resulting in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

attacker could have created a malicious link using bidirectional characters to spoof the location in the address bar when visited

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Memory safety bugs present in Firefox 119, Firefox ESR 115

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When using X11, text selected by the page using the Selection API was erroneously copied into the primary selection, a temporary storage not unlike the clipboard

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Ownership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability affects Firefox < 120, Firefox ESR < 115

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

It was possible to cause the use of a MessagePort after it had already been freed, which could potentially have led to an exploitable crash

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

On some systems—depending on the graphics settings and drivers—it was possible to force an out-of-bounds read and leak memory data into the images created on the canvas element

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Memory safety bugs present in Firefox 120, Firefox ESR 115

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

`ShutdownObserver()` was susceptible to potentially undefined behavior due to its reliance on a dynamic type that lacked a virtual destructor

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

use-after-free was identified in the `nsDNSService::Init`

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

`nsWindow::PickerOpen(void)` method was susceptible to a heap buffer overflow when running in headless mode

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

timing of a button click causing a popup to disappear was approximately the same length as the anti-clickjacking delay on permission prompts

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

`VideoBridge` allowed any content process to use textures produced by remote decoders

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

use-after-free condition affected TLS socket creation when under memory pressure

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Firefox was susceptible to a heap buffer overflow in `nsTextFragment` due to insufficient OOM handling

firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When resolving a symlink, a race may occur where the buffer passed to `readlink` may actually be smaller than necessary