Mozilla Firefox

Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152

Undefined behavior in the WebRTC: Signaling component

Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird 128.11

Memory safety bugs fixed in Firefox 137 and Thunderbird 137

Save as in Devtools could download files without sanitizing the extension

Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146

Mitigation bypass in the Safe Browsing component

Mitigation bypass in the Data Loss Prevention component

DNS rebinding circumvents CORS

Inconsistent comparator in XSLT sorting led to out-of-bounds access

Memory safety bugs fixed in Firefox 150.0.2

A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via `performance.getEntries()`. This vulnerability affects Firefox < 106, Firefox ESR < 102.4, and Thunderbird < 102.4.

Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152

Mitigation bypass in the DOM: Security component

Memory safety bug fixed in Firefox 152

Mitigation bypass in the DOM: Security component

Clickjacking issue in the Widget component

Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142

Memory safety bugs fixed in Firefox 152 and Thunderbird 152

Potential user-assisted code execution in “Copy as cURL” command

Spoofing issue in the Site Permissions component

Memory safety bugs fixed in Firefox 145 and Thunderbird 145

Potential user-assisted code execution in “Copy as cURL” command

javascript: URLs executed on object and embed tags

XSLT documents could bypass CSP

Search terms persisted in URL bar

Web application manifests were stored by using an insecure MD5 hash which allowed for a hash collision to overwrite another application's manifest. This could have been exploited to run arbitrary code in another application's context. *This issue only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 126.

Spoofing risk in Android custom tabs

Mitigation bypass in the DOM: Security component

Same-origin policy bypass in the DOM: Notifications component

Same-origin policy bypass in the DOM: Workers component

Same-origin policy bypass in the Graphics: Canvas2D component

Site isolation issue in the WebExtensions component

Site isolation issue in the Networking: Cookies component

Site isolation issue in the Audio/Video: Web Codecs component

A maliciously crafted page loaded to the sidebar through a bookmark can reference a privileged chrome window and engage in limited JavaScript operations violating cross-origin protections. This vulnerability affects Firefox < 50.

Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Mozilla Firefox 3.0.x, 3.5, and 3.5.1 on Windows allows remote attackers to cause a denial of service (uncaught exception and application crash) via a long Unicode string argument to the write method. NOTE: this was originally reported as a stack-based buffer overflow. NOTE: on Linux and Mac OS X, a crash resulting from this long string reportedly occurs in an operating-system library, not in Firefox.

Directory traversal vulnerability in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allows remote attackers to bypass "restrictions imposed on local HTML files," and obtain sensitive information and prompt users to write this information into a file, via directory traversal sequences in a resource: URI.