Mozilla Firefox any version

Incorrect boundary conditions in the Graphics: ImageLib component

Incorrect boundary conditions in the Web Audio component

Undefined behavior in the DOM: Core & HTML component

Sandbox escape due to incorrect boundary conditions in the Graphics component

Internally found bugs fixed in Thunderbird ESR 153.1 and Thunderbird 154

Incorrect boundary conditions in the Audio/Video: GMP component

Use-after-free in the Graphics: ImageLib component

Use-after-free in the Graphics: Text component

Use-after-free in the Audio/Video: Playback component

Use-after-free in the JavaScript Engine component

Use-after-free in the JavaScript Engine: JIT component

Use-after-free in the JavaScript Engine component

Use-after-free in the JavaScript: GC component

JIT miscompilation, use-after-free in the JavaScript Engine: JIT component

Use-after-free in the DOM: Bindings (WebIDL) component

Use-after-free in the JavaScript: WebAssembly component

Sandbox escape in the Profile Backup component

Uninitialized memory in the Audio/Video: Web Codecs component

Memory safety bugs present in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.

Use-after-free in the WebRTC: Signaling component

Incorrect boundary conditions in the Audio/Video: Playback component

Memory safety bugs present in Firefox 123. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 124.

Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20, and Thunderbird 128.7

Use-after-free in the DOM: Core & HTML component

Use-after-free in the JavaScript: WebAssembly component

Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2

Incorrect boundary conditions in the Networking: JAR component

The search term could have been specified externally to trigger SQL injection. This vulnerability affects Firefox for iOS < 101.

Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7

If an out-of-memory condition occurs at a specific point using allocations in the probabilistic heap checker, an assertion could have been triggered, and in rarer situations, memory corruption could have occurred. This vulnerability affects Firefox < 127.

Memory safety bugs present in Firefox 126. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 127.

Spoofing issue in the WebAuthn component in Firefox for Android

A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an exploitable type confusion vulnerability. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and Thunderbird < 128.2.

Invalid pointer in the DOM: Core & HTML component

Multiple WebRTC threads could have claimed a newly connected audio input leading to use-after-free. This vulnerability affects Firefox < 126.

Other issue in the Profile Backup component

Internally found bugs fixed in Thunderbird 154

Privilege escalation in the Messaging System component

Sandbox escape due to invalid pointer in the Audio/Video: GMP component

Mitigation bypass in the DOM: HTML Parser component