Mozilla Thunderbird

A malicious devtools extension could have been used to escalate privileges. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7.

Heap buffer overflow in libvpx

Unexpected marking work at the start of sweeping could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.

Use-after-free in the Storage: IndexedDB component

When saving a page to PDF, certain font styles could have led to a potential use-after-free crash. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.

Privilege escalation in the Graphics: WebRender component

Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151

It is currently unknown if this issue is exploitable but a condition may arise where the structured clone of certain objects could lead to memory corruption. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131.

Memory corruption in NSS

Leaving pointerlock by pressing the escape key could be prevented

When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after where it should not be possible. This vulnerability affects Firefox < 96, Thunderbird < 91.6, and Firefox ESR < 91.6.

Memory safety bugs present in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.

A potential memory corruption vulnerability could be triggered if an attacker had the ability to trigger an OOM at a specific moment during JIT compilation. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131.

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Privilege escalation in the Graphics: CanvasWebGL component

Use-after-free in the Layout: Text and Fonts component

Use-after-free in the IPC component

Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1

Privilege escalation due to use-after-free in the Graphics: Canvas2D component

Use-after-free in the DOM: Core & HTML component

Memory safety bugs fixed in Firefox 151

Privilege escalation in the DOM: Navigation component

Privilege escalation in the DOM: Networking component

Privilege escalation in the Remote Settings Client component

Privilege escalation due to invalid pointer in the Graphics component

Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151

Memory safety bugs fixed in Firefox 128 and Thunderbird 128

Privilege escalation in the Shell Integration component

Privilege escalation in the Networking: Cookies component

Privilege escalation in the WebRTC: Audio/Video component

Privilege escalation in the WebDriver BiDi component

Use-after-free in the JavaScript: GC component

Privilege escalation due to use-after-free in the Graphics: WebGPU component

Privilege escalation in the Security component

Privilege escalation in the Downloads API component

Privilege escalation in the Debugger component

Privilege escalation in the Application Update component

Privilege escalation in the DOM: Workers component

Privilege escalation in the DOM: Notifications component

Privilege escalation in the Request Handling component