MozillaThunderbird vulnerabilities (SUSE)
1,376 vulnerabilities.
MozillaThunderbirdSUSEThe Mozilla Fuzzing Team reported potential vulnerabilities present in Thunderbird 91.10. Some of...8.8 HighMozillaThunderbirdSUSEIn the <code>nsTArray_Impl::ReplaceElementsAt()</code> function, an integer overflow could have...8.8 HighMozillaThunderbirdSUSEA malicious website that could create a popup could have resized the popup to overlay the address...6.5 MediumMozillaThunderbirdSUSEIf there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests...4.3 MediumMozillaThunderbirdSUSESession history navigations may have led to a use-after-free and potentially exploitable crash....9.8 CriticalMozillaThunderbirdSUSEAn iframe that was not permitted to run scripts could do so if the user clicked on a <code...8.8 HighMozillaThunderbirdSUSEIf an object prototype was corrupted by an attacker, they would have been able to set undesired...8.8 HighMozillaThunderbirdSUSEWhen downloading files on Windows, the % character was not escaped, which could have lead to a...8.8 HighMozillaThunderbirdSUSEMozilla developers Andrew McCreight, Nicolas B. Pierron, and the Mozilla Fuzzing Team reported...9.8 CriticalMozillaThunderbirdSUSEAn attacker could have injected CSS into stylesheets accessible via internal URIs, such as...6.5 MediumMozillaThunderbirdSUSEAn attacker could have exploited a timing attack by sending a large number of allowCredential...6.5 MediumMozillaThunderbirdSUSEA crafted CMS message could have been processed incorrectly, leading to an invalid memory read,...8.8 HighMozillaThunderbirdSUSEOn arm64, WASM code could have resulted in incorrect assembly generation leading to a register...8.8 HighMozillaThunderbirdSUSEWhen exiting fullscreen mode, an iframe could have confused the browser about the current state...6.5 MediumMozillaThunderbirdSUSEA malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory...9.8 CriticalMozillaThunderbirdSUSEA malicious website could have learned the size of a cross-origin resource that supported Range...9.8 CriticalMozillaThunderbirdSUSEWhen displaying the sender of an email, and the sender name contained the Braille Pattern Blank...6.5 MediumMozillaThunderbirdSUSEIf an attacker was able to corrupt the methods of an Array object in JavaScript via prototype...8.8 HighMozillaThunderbirdSUSEAn attacker could have sent a message to the parent process where the contents were used to...8.8 HighMozillaThunderbirdSUSEThe parent process would not properly check whether the Speech Synthesis feature is enabled, when...6.5 MediumMozillaThunderbirdSUSEWhen viewing an email message A, which contains an attached message B, where B is encrypted or...4.3 MediumMozillaThunderbirdSUSEMozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team...9.8 CriticalMozillaThunderbirdSUSEFirefox behaved slightly differently for already known resources when loading CSS resources...6.5 MediumMozillaThunderbirdSUSEWhen reusing existing popups Firefox would have allowed them to cover the fullscreen notification...6.5 MediumMozillaThunderbirdSUSERequests initiated through reader mode did not properly omit cookies with a SameSite attribute....6.1 MediumMozillaThunderbirdSUSEAn improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user...6.1 MediumMozillaThunderbirdSUSEDocuments in deeply-nested cross-origin browsing contexts could have obtained permissions granted...8.8 HighMozillaThunderbirdSUSEWhen importing a revoked key that specified key compromise as the revocation reason, Thunderbird...5.4 MediumMozillaThunderbirdSUSEMozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the...8.8 HighMozillaThunderbirdSUSEDue to a layout change, iframe contents could have been rendered outside of its border. This...5.4 MediumMozillaThunderbirdSUSEWhen generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect...6.5 MediumMozillaThunderbirdSUSEBy using a link with <code>rel="localization"</code> a use-after-free could have been triggered...6.5 MediumMozillaThunderbirdSUSEIf a compromised content process sent an unexpected number of WebAuthN Extensions in a Register...8.8 HighMozillaThunderbirdSUSEAfter a VR Process is destroyed, a reference to it may have been retained and used, leading to a...6.5 MediumMozillaThunderbirdSUSE<code>NSSToken</code> objects were referenced via direct points, and could have been accessed in...6.5 MediumMozillaThunderbirdSUSEWhen installing an add-on, Firefox verified the signature before prompting the user; but while...7.5 HighMozillaThunderbirdSUSEPreviously Firefox for macOS and Linux would download temporary files to a user-specific...6.5 MediumMozillaThunderbirdSUSEIf an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code>...9.6 CriticalMozillaThunderbirdSUSEWhen resizing a popup after requesting fullscreen access, the popup would not display the...4.3 MediumMozillaThunderbirdSUSEAn attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading...8.8 HighMozillaThunderbirdSUSERegular expression denial of service in Rust's regex crate7.5 HighMozillaThunderbirdSUSEAn unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable...9.6 CriticalMozillaThunderbirdSUSERemoving an XSLT parameter during processing could have lead to an exploitable use-after-free. We...8.8 HighMozillaThunderbirdSUSEA Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused...7.1 HighMozillaThunderbirdSUSEIt may be possible for an attacker to craft an email message that causes Thunderbird to perform...8.8 HighMozillaThunderbirdSUSEMozilla developers Paul Adenot and the Mozilla Fuzzing Team reported memory safety bugs present...8.8 HighMozillaThunderbirdSUSEWhen a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a...8.8 HighMozillaThunderbirdSUSEWeb-accessible extension pages (pages with a moz-extension:// scheme) were not correctly...8.8 HighMozillaThunderbirdSUSEWhen importing resources using Web Workers, error messages would distinguish the difference...6.5 MediumMozillaThunderbirdSUSEIf a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently...9.6 Critical- Show moreLoading…