Mozilla Firefox any version

Memory safety bugs present in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.

Mozilla developers Gabriele Svelto, Randell Jesup and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 99. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 100.

After downloading a Windows <code>.scf</code> script from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requests from the operating system. This also had the potential to leak NTLM credentials to the resource.<br>*This bug only affects Firefox for Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 110.

Mozilla developers and community members Randell Jesup, Sebastian Hengst, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 98. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 99.

Mozilla developers and community members Gabriele Svelto, Sebastian Hengst, Randell Jesup, Luan Herrera, Lars T Hansen, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 96. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 97.

An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object's debugger vector. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.

Memory safety bugs present in Firefox 111. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.

Memory safety bugs fixed in Firefox 109

Mozilla developers Christian Holler and Jason Kratzer reported memory safety bugs present in Firefox 95. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 96.

A potential memory corruption vulnerability could be triggered if an attacker had the ability to trigger an OOM at a specific moment during JIT compilation. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131.

Mozilla developers Timothy Nikkel, Ashley Hale, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 105. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 106.

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Privilege escalation in the Graphics: CanvasWebGL component

A potential use-after-free vulnerability existed in SVG Images if the Refresh Driver was destroyed at an inopportune time. This could have lead to memory corruption or a potentially exploitable crash. *Note*: This advisory was added on December 13th, 2022 after discovering it was inadvertently left out of the original advisory. The fix was included in the original release of Firefox 106. This vulnerability affects Firefox < 106.

Use-after-free in the Layout: Text and Fonts component

Use-after-free in the IPC component

Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1

Privilege escalation due to use-after-free in the Graphics: Canvas2D component

Incorrect boundary conditions in the Graphics: WebGPU component

Use-after-free in the DOM: Core & HTML component

Memory safety bugs fixed in Firefox 151

JIT miscompilation in the JavaScript Engine: JIT component

Privilege escalation in the DOM: Navigation component

Privilege escalation in the Remote Settings Client component

Privilege escalation in the DOM: Networking component

Privilege escalation due to invalid pointer in the Graphics component

Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151

Memory safety bugs fixed in Firefox 128 and Thunderbird 128

Privilege escalation in the Networking: Cookies component

Privilege escalation in the Shell Integration component

Privilege escalation in the WebDriver BiDi component

Privilege escalation in the WebRTC: Audio/Video component

Privilege escalation due to use-after-free in the Graphics: WebGPU component

Use-after-free in the JavaScript: GC component

Privilege escalation in the IPC component

Privilege escalation in the DOM: Workers component

Privilege escalation in the Request Handling component

Privilege escalation in the Application Update component

Privilege escalation in the Downloads API component

Privilege escalation in the Security component