firefox vulnerabilities (Ubuntu)
1,530 vulnerabilities.
firefoxUbuntuWhen reading from areas partially or fully outside the source resource with WebGL's <code...7.5 HighfirefoxUbuntuUnder certain conditions, when handling a ReadableStream, a race condition can cause a use-after...8.1 HighfirefoxUbuntuUnder certain conditions, when running the nsDocShell destructor, a race condition can cause a...8.1 HighfirefoxUbuntuMozilla developers reported memory safety and script safety bugs present in Firefox 73. Some of...9.8 CriticalfirefoxUbuntuMozilla developers reported memory safety bugs present in Firefox and Thunderbird 68.5. Some of...9.8 CriticalfirefoxUbuntuWhen protecting CSS blocks with the nonce feature of Content Security Policy, the @import...5.3 MediumfirefoxUbuntuThe first time AirPods are connected to an iPhone, they become named after the user's name by...5.3 MediumfirefoxUbuntuThe 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a...8.8 HighfirefoxUbuntuAfter a website had entered fullscreen mode, it could have used a previously opened popup to...4.3 MediumfirefoxUbuntuWhen a JavaScript URL (javascript:) is evaluated and the result is a string, this string is...6.5 MediumfirefoxUbuntuWhen a device was changed while a stream was about to be destroyed, the <code>stream-reinit</code...8.8 HighfirefoxUbuntuBy carefully crafting promise resolutions, it was possible to cause an out-of-bounds read off the...8.8 HighfirefoxUbuntuWhen removing data about an origin whose tab was recently closed, a use-after-free could occur in...8.8 HighfirefoxUbuntuWhen a Web Extension had the all-urls permission and made a fetch request with a mode set to ...7.5 HighfirefoxUbuntuusrsctp before 2019-12-20 has out-of-bounds reads in sctp_load_addresses_from_init.6.5 MediumfirefoxUbuntufirefox regressionsNo scorefirefoxUbuntuMozilla developers reported memory safety bugs present in Firefox 72. Some of these bugs showed...8.8 HighfirefoxUbuntuMozilla developers and community members reported memory safety bugs present in Firefox 72 and...8.8 HighfirefoxUbuntuIf a template tag was used in a select tag, the parser could be confused and allow JavaScript...6.1 MediumfirefoxUbuntuA content process could have modified shared memory relating to crash reporting information,...8.8 HighfirefoxUbuntufirefox regressionsNo scorefirefoxUbuntuIncorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a...8.8 HighfirefoxUbuntuMozilla developers reported memory safety bugs present in Firefox 71. Some of these bugs showed...8.8 HighfirefoxUbuntuMozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3. Some...8.8 HighfirefoxUbuntuAfter a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3,...6.5 MediumfirefoxUbuntuWhen pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer...6.1 MediumfirefoxUbuntuIf an XML file is served with a Content Security Policy and the XML file includes an XSL...6.5 MediumfirefoxUbuntuDue to a missing case handling object types, a type confusion vulnerability could occur,...8.8 HighfirefoxUbuntuWhen pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer...6.1 MediumfirefoxUbuntuIf an image had not loaded correctly (such as when it is not actually an image), it could be...7.4 HighfirefoxUbuntuMozilla developers reported memory safety bugs present in Firefox 70. Some of these bugs showed...8.8 HighfirefoxUbuntuMozilla developers reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2. Some...8.8 HighfirefoxUbuntuUnder certain conditions, when retrieving a document from a DocShell in the antitracking code, a...7.5 HighfirefoxUbuntuUnder certain conditions, when checking the Resist Fingerprinting preference during device...7.5 HighfirefoxUbuntuWhen using nested workers, a use-after-free could occur during worker destruction. This resulted...8.8 HighfirefoxUbuntuThe plain text serializer used a fixed-size array for the number of <ol> elements it could...8.8 HighfirefoxUbuntuImproper refcounting of soft token session objects could cause a use-after-free and crash (likely...8.8 HighfirefoxUbuntuWhen encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller...8.8 HighfirefoxUbuntufirefox regressionsNo scorefirefoxUbuntuIf upgrade-insecure-requests was specified in the Content Security Policy, and a link was dragged...4.3 MediumfirefoxUbuntuA Content-Security-Policy that blocks in-line scripts could be bypassed using an object tag to...6.1 MediumfirefoxUbuntuAn object tag with a data URI did not correctly inherit the document's Content Security Policy....6.1 MediumfirefoxUbuntuA compromised content process could send a message to the parent process that would cause the ...6.5 MediumfirefoxUbuntuMozilla developers and community members reported memory safety bugs present in Firefox 69 and...8.8 HighfirefoxUbuntuFailure to correctly handle null bytes when processing HTML entities resulted in Firefox...6.1 MediumfirefoxUbuntuIf two same-origin documents set document.domain differently to become cross-origin, it was...6.1 MediumfirefoxUbuntuBy using a form with a data URI it was possible to gain access to the privileged JSONView object...5.4 MediumfirefoxUbuntuA fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling. This resulted...8.8 HighfirefoxUbuntuAn attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer...8.8 HighfirefoxUbuntuWhen following the value's prototype chain, it was possible to retain a reference to a locale,...8.8 High- Show moreLoading…