firefox vulnerabilities (Red Hat)
2,057 vulnerabilities.
firefoxRed HatWhen injecting an HTML base element, some requests would ignore the CSP's base-uri settings and...6.1 MediumfirefoxRed Hatlibexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.8.1 HighfirefoxRed HatMembers the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103, Firefox ESR...8.8 HighfirefoxRed HatMozilla developer Nika Layzell and the Mozilla Fuzzing Team reported memory safety bugs present...8.8 HighfirefoxRed HatA data race could occur in the <code>PK11_ChangePW</code> function, potentially leading to a use...7.5 HighfirefoxRed HatA cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions ...8.8 HighfirefoxRed HatAn attacker could have abused XSLT error handling to associate attacker-controlled content with...6.5 MediumfirefoxRed HatMozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox...8.8 HighfirefoxRed HatWhen combining CSS properties for overflow and transform, the mouse cursor could interact with...7.5 HighfirefoxRed HatWhen visiting directory listings for `chrome://` URLs as source text, some parameters were...5.3 MediumfirefoxRed HatThe Mozilla Fuzzing Team reported potential vulnerabilities present in Thunderbird 91.10. Some of...8.8 HighfirefoxRed HatIn the <code>nsTArray_Impl::ReplaceElementsAt()</code> function, an integer overflow could have...8.8 HighfirefoxRed HatA malicious website that could create a popup could have resized the popup to overlay the address...6.5 MediumfirefoxRed HatIf there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests...4.3 MediumfirefoxRed HatSession history navigations may have led to a use-after-free and potentially exploitable crash....9.8 CriticalfirefoxRed HatAn iframe that was not permitted to run scripts could do so if the user clicked on a <code...8.8 HighfirefoxRed HatIf an object prototype was corrupted by an attacker, they would have been able to set undesired...8.8 HighfirefoxRed HatMozilla developers Andrew McCreight, Nicolas B. Pierron, and the Mozilla Fuzzing Team reported...9.8 CriticalfirefoxRed HatAn attacker could have injected CSS into stylesheets accessible via internal URIs, such as...6.5 MediumfirefoxRed HatAn attacker could have exploited a timing attack by sending a large number of allowCredential...6.5 MediumfirefoxRed HatA crafted CMS message could have been processed incorrectly, leading to an invalid memory read,...8.8 HighfirefoxRed HatOn arm64, WASM code could have resulted in incorrect assembly generation leading to a register...8.8 HighfirefoxRed HatWhen exiting fullscreen mode, an iframe could have confused the browser about the current state...6.5 MediumfirefoxRed HatA malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory...9.8 CriticalfirefoxRed HatA malicious website could have learned the size of a cross-origin resource that supported Range...9.8 CriticalfirefoxRed HatIf an attacker was able to corrupt the methods of an Array object in JavaScript via prototype...8.8 HighfirefoxRed HatAn attacker could have sent a message to the parent process where the contents were used to...8.8 HighfirefoxRed HatMozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team...9.8 CriticalfirefoxRed HatFirefox behaved slightly differently for already known resources when loading CSS resources...6.5 MediumfirefoxRed HatWhen reusing existing popups Firefox would have allowed them to cover the fullscreen notification...6.5 MediumfirefoxRed HatRequests initiated through reader mode did not properly omit cookies with a SameSite attribute....6.1 MediumfirefoxRed HatAn improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user...6.1 MediumfirefoxRed HatDocuments in deeply-nested cross-origin browsing contexts could have obtained permissions granted...8.8 HighfirefoxRed HatMozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the...8.8 HighfirefoxRed HatDue to a layout change, iframe contents could have been rendered outside of its border. This...5.4 MediumfirefoxRed HatWhen generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect...6.5 MediumfirefoxRed HatBy using a link with <code>rel="localization"</code> a use-after-free could have been triggered...6.5 MediumfirefoxRed HatIf a compromised content process sent an unexpected number of WebAuthN Extensions in a Register...8.8 HighfirefoxRed HatAfter a VR Process is destroyed, a reference to it may have been retained and used, leading to a...6.5 MediumfirefoxRed Hat<code>NSSToken</code> objects were referenced via direct points, and could have been accessed in...6.5 MediumfirefoxRed HatWhen installing an add-on, Firefox verified the signature before prompting the user; but while...7.5 HighfirefoxRed HatPreviously Firefox for macOS and Linux would download temporary files to a user-specific...6.5 MediumfirefoxRed HatIf an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code>...9.6 CriticalfirefoxRed HatWhen resizing a popup after requesting fullscreen access, the popup would not display the...4.3 MediumfirefoxRed HatAn attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading...8.8 HighfirefoxRed HatRegular expression denial of service in Rust's regex crate7.5 HighfirefoxRed HatAn unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable...9.6 CriticalfirefoxRed HatRemoving an XSLT parameter during processing could have lead to an exploitable use-after-free. We...8.8 HighfirefoxRed HatIn Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.9.8 CriticalfirefoxRed Hatxmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator...9.8 Critical- Show moreLoading…