Mozilla Firefox

An out-of-bounds read while processing SVG content in "ConvolvePixel". This results in a crash and also allows for otherwise inaccessible memory being copied into SVG graphic content, which could then displayed. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

An out-of-bounds read during the processing of glyph widths during text layout. This results in a potentially exploitable crash and could allow an attacker to read otherwise inaccessible memory. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer being off by 8 bytes after a bailout. This leaks a memory address to the calling function which can be used as part of an exploit inside the sandboxed content process. This vulnerability affects Firefox ESR < 60.2.2 and Firefox < 62.0.3.

The libxul.so!gfxContext::Polygon function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive information from process memory, cause a denial of service (out-of-bounds read and application crash), or possibly bypass the Same Origin Policy via vectors involving MathML polygon rendering.

An out-of-bounds read occurs when applying style rules to pseudo-elements, such as ::first-line, using cached style data. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.

An out-of-bounds read vulnerability with the Opus encoder when the number of channels in an audio stream changes while the encoder is in use. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.

An issue with incorrect ownership model of "privateBrowsing" information exposed through developer tools. This can result in a non-exploitable crash when manually triggered during debugging. This vulnerability affects Firefox < 53.

Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Silf::readGraphite function.

`NSC_DeriveKey` inadvertently assumed that the `phKey` parameter is always non-NULL. When it was passed as NULL, a segmentation fault (SEGV) occurred, leading to crashes. This behavior conflicted with the PKCS#11 v3.0 specification, which allows `phKey` to be NULL for certain mechanisms. This vulnerability affects Firefox < 133 and Thunderbird < 133.

Editor code failed to check an attribute value. This could have led to an out-of-bounds read. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.

It was possible for a web extension with minimal permissions to create a `StreamFilter` which could be used to read and modify the response body of requests on any site. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.

Uninitialized memory in the Graphics: Text component

Site isolation issue in the CSS Parsing and Computation component

Same-origin policy bypass in the DOM: Service Workers component

Mitigation bypass in the Storage: Cache API component

Same-origin policy bypass in the DOM: Networking component

Process isolation bypass using "javascript:" URI links in cross-origin frames

Side-channel in the Web Audio component

Mitigation bypass in the JavaScript: GC component

Uninitialized memory in the Graphics: Canvas2D component

Undefined behavior in the Audio/Video component

Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component

Scanning a malicious URL utilizing Firefox's open-text scheme with the QR code scanner could load arbitrary websites

Opening an external link to an HTTP website when Firefox iOS was previously closed and had an HTTPS tab open could in some cases result in the padlock icon showing an HTTPS indicator incorrectly This vulnerability affects Firefox for iOS < 131.2.

connect-src Content Security Policy restriction could be bypassed

Lock screen setting bypass in Firefox Focus for Android

JIT miscompilation in the JavaScript Engine: JIT component

Mitigation bypass in the Enterprise Policies component

Mitigation bypass in the Networking component

Mitigation bypass in the DOM: Networking component

Incorrect boundary conditions in the Audio/Video: Playback component

Incorrect boundary conditions in the Graphics: WebGPU component

The password edit screen was not hidden in Android card view

Incorrect boundary conditions in the Audio/Video: GMP component

Mitigation bypass in the DOM: Security component

Mitigation bypass in the Networking component

Mitigation bypass in the DOM: Security component

Mitigation bypass in the DOM: Security component

Nameless cookies shadow secure cookies

Same-origin policy bypass in the Networking: Cookies component