Mozilla Thunderbird

Integer overflow in the Widget: Win32 component

An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially exploitable crash. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firefox ESR < 115.17, Thunderbird < 128.4, and Thunderbird < 132.

Denial-of-service due to integer overflow in the Graphics: WebGPU component

ANGLE failed to initialize parameters which lead to reading from uninitialized memory. This could be leveraged to leak sensitive data from memory. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.

Use-after-free in the DOM: Core & HTML component

Use-after-free in the JavaScript Engine component

Use-after-free in the WebRTC component

Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8

Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, Thunderbird 128, and Thunderbird 115.13

Use-after-free in WebTransportChild

Incorrect boundary conditions in the JavaScript: WebAssembly component

Denial-of-service in the Widget component

Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component

Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150

Truncation of a long URL could have allowed origin spoofing in a permission prompt. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.

A clipboard "paste" button could persist across tabs which allowed a spoofing attack. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.

Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150

Copying sensitive information from Private Browsing tabs on Android, such as passwords, may have inadvertently stored data in the cloud-based clipboard history if enabled. This vulnerability affects Firefox < 133 and Thunderbird < 133.

An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://devtools` origin. This could allow them to access cross-origin JSON content. This access is limited to "same site" documents by the Site Isolation feature on desktop clients, but full cross-origin access is possible on Android versions. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thunderbird < 128.3, and Thunderbird < 131.

Use-after-free in the Widget: Cocoa component

Denial-of-service in the XML component

Denial-of-service in the Audio/Video: Playback component

Denial-of-service in the Libraries component in NSS

Denial-of-service in the Audio/Video: Playback component

Use-after-free in the JavaScript: WebAssembly component

A website configured to initiate a specially crafted WebTransport session could crash the Firefox process leading to a denial of service condition. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131.

Incorrect boundary conditions in the WebRTC component

Uninitialized memory in the Audio/Video: Web Codecs component

Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1

Incorrect boundary conditions in the WebRTC component

Incorrect boundary conditions in the Libraries component in NSS

Information disclosure in the WebRTC component

A double-free could have occurred in `vpx_codec_enc_init_multi` after a failed allocation when initializing the encoder for WebRTC. This could have caused memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 139 and Thunderbird < 128.11.

Information disclosure, mitigation bypass in the Settings UI component

Use-after-free in the DOM: Bindings (WebIDL) component

Use-after-free in the DOM: Networking component

Information disclosure in the Networking: HTTP component

Information disclosure due to side-channel in the Storage: Cache API component

Information disclosure in the Graphics: WebGPU component

Information disclosure in the Form Autofill component