Mozilla Firefox

Use-after-free in the WebRTC: Signaling component

Memory safety bugs present in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.

Uninitialized memory in the Audio/Video: Web Codecs component

Sandbox escape in the Profile Backup component

Incorrect boundary conditions in the Audio/Video: Playback component

Memory safety bugs present in Firefox 123. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 124.

Use-after-free in the DOM: Core & HTML component

Use-after-free in the JavaScript: WebAssembly component

Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20, and Thunderbird 128.7

Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2

Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and Thunderbird < 128.2.

Incorrect boundary conditions in the Networking: JAR component

The search term could have been specified externally to trigger SQL injection. This vulnerability affects Firefox for iOS < 101.

Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7

If an out-of-memory condition occurs at a specific point using allocations in the probabilistic heap checker, an assertion could have been triggered, and in rarer situations, memory corruption could have occurred. This vulnerability affects Firefox < 127.

Memory safety bugs present in Firefox 126. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 127.

Spoofing issue in the WebAuthn component in Firefox for Android

A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an exploitable type confusion vulnerability. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and Thunderbird < 128.2.

Invalid pointer in the DOM: Core & HTML component

Multiple WebRTC threads could have claimed a newly connected audio input leading to use-after-free. This vulnerability affects Firefox < 126.

Internally found bugs fixed in Thunderbird 154

Other issue in the Profile Backup component

Sandbox escape due to invalid pointer in the Audio/Video: GMP component

Privilege escalation in the Messaging System component

Mitigation bypass in the DOM: HTML Parser component

JIT miscompilation in the JavaScript Engine: JIT component

Incorrect boundary conditions, integer overflow in the Libraries component in NSS

Internally found bugs fixed in Firefox 155

Integer overflow in the Libraries component in NSS

Memory safety bugs fixed in Firefox 135 and Thunderbird 135

Mitigation bypass in the DOM: Security component

Mitigation bypass in the Networking: Cache component

Use-after-free in the JavaScript Engine component

A compromised content process could have allowed for the arbitrary loading of cross-origin pages. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thunderbird < 128.3, and Thunderbird < 131.

Privilege escalation in the Enterprise Policies component

Mitigation bypass in the Add-ons Manager component

Mitigation bypass in the DOM: Security component

Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153

Invalid pointer in the DOM: Bindings (WebIDL) component

Incorrect garbage collection interaction in IndexedDB could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < 128.1, and Thunderbird < 128.1.