Mozilla Thunderbird any version

Use-after-free in the WebRTC: Signaling component

Memory safety bugs present in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.

Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149

Use-after-free in the DOM: Core & HTML component

Use-after-free in the JavaScript: WebAssembly component

Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20, and Thunderbird 128.7

Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2

Incorrect boundary conditions in the Networking: JAR component

Memory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7

Spoofing issue in the WebAuthn component in Firefox for Android

Invalid pointer in the DOM: Core & HTML component

Incorrect boundary conditions in the Audio/Video component

Other issue in the Profile Backup component

Internally found bugs fixed in Thunderbird 154

Privilege escalation in the Messaging System component

Sandbox escape due to invalid pointer in the Audio/Video: GMP component

Mitigation bypass in the DOM: HTML Parser component

JIT miscompilation in the JavaScript Engine: JIT component

Incorrect boundary conditions, integer overflow in the Libraries component in NSS

Internally found bugs fixed in Firefox 155

Integer overflow in the Libraries component in NSS

Memory safety bugs fixed in Firefox 135 and Thunderbird 135

Ambiguous parsing of mail headers

Mitigation bypass in the DOM: Security component

Mitigation bypass in the Networking: Cache component

A compromised content process could have allowed for the arbitrary loading of cross-origin pages. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thunderbird < 128.3, and Thunderbird < 131.

Privilege escalation in the Enterprise Policies component

Mitigation bypass in the DOM: Security component

Mitigation bypass in the Add-ons Manager component

Invalid pointer in the DOM: Bindings (WebIDL) component

Incorrect garbage collection interaction in IndexedDB could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < 128.1, and Thunderbird < 128.1.

Mitigation bypass in the Networking: Cookies component

Mitigation bypass in the Networking: Cookies component

Use-after-free in MediaTrackGraphImpl::GetInstance()

Large branch table could lead to truncated instruction

JIT miscompilation in the JavaScript Engine: JIT component

Memory safety bugs fixed in Firefox 148 and Thunderbird 148

Use-after-free in the DOM: Window and Location component

Use-after-free in the Graphics: ImageLib component

Use-after-free in the JavaScript Engine component