Mozilla Thunderbird any version

Disclosure of uninitialized memory when .toUpperCase() causes string to get longer

Use-after-free in the JavaScript: GC component

Use-after-free in the DOM: Core & HTML component

Use-after-free in the JavaScript: GC component

Thunderbird versions prior to 91.3.0 are vulnerable to the heap overflow described in CVE-2021-43527 when processing S/MIME messages. Thunderbird versions 91.3.0 and later will not call the vulnerable code when processing S/MIME messages that contain certificates with DER-encoded DSA or RSA-PSS signatures.

Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153

Invalid pointer in the JavaScript Engine component

Incorrect URL stripping in CSP reports

Memory safety bugs fixed in Firefox 149 and Thunderbird 149

Use-after-free in Custom Highlight

Use-after-free in the Audio/Video: GMP component

Memory safety bugs fixed in Firefox 149.0.2 and Thunderbird 149.0.2

Memory safety bugs fixed in Firefox 147 and Thunderbird 147

Use-after-free in the JavaScript Engine component

Use-after-free during concurrent delazification

Memory safety bugs fixed in Firefox 142 and Thunderbird 142

Memory safety bugs fixed in Firefox 141 and Thunderbird 141

Privilege escalation in the Netmonitor component

JIT miscompilation in the JavaScript: WebAssembly component

Integer overflow in the JavaScript: WebAssembly component

Privilege escalation in the Netmonitor component

Cross-process information leaked due to malicious IPC messages

Out of bounds read/write in a privileged process triggered by WebGL textures

JIT miscompilation in the JavaScript Engine: JIT component

Incorrect boundary conditions in the Audio/Video: cubeb component

Incorrect boundary conditions in the Graphics component

Sandbox escape due to use-after-free in the Disability Access APIs component

Sandbox escape due to use-after-free in the Disability Access APIs component

Sandbox escape due to use-after-free in the DOM: Navigation component

Potential race conditions in IndexedDB could have caused memory corruption, leading to a potentially exploitable crash. This vulnerability affects Firefox < 132 and Thunderbird < 132.

Incorrect boundary conditions in the JavaScript: WebAssembly component

Mitigation bypass in the PDF Viewer component

Mitigation bypass in the DOM: Networking component

Incorrect URL truncation

Other issue in the DOM: Navigation component

Mitigation bypass in the DOM: Service Workers component

Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15

Sandbox escape in the DOM: Networking component

Memory safety bug fixed in Firefox 144 and Thunderbird 144

Use-after-free caused by the native messaging web extension API on Windows