firefox vulnerabilities (Ubuntu)
1,530 vulnerabilities.
firefoxUbuntubuild_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.9.8 CriticalfirefoxUbuntudefineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.9.8 CriticalfirefoxUbuntulookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.8.8 HighfirefoxUbuntunextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.8.8 HighfirefoxUbuntustoreAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.8.8 HighfirefoxUbuntuIn doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for...8.1 HighfirefoxUbuntuIn Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts...8.8 HighfirefoxUbuntuIt was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox....10.0 CriticalfirefoxUbuntufirefox regressionsNo scorefirefoxUbuntuIt was possible to recreate previous cursor spoofing attacks against users with a zoomed native...4.3 MediumfirefoxUbuntuUsing the Location API in a loop could have caused severe application hangs and crashes. This...6.5 MediumfirefoxUbuntuDocuments loaded with the CSP sandbox directive could have escaped the sandbox's script...6.1 MediumfirefoxUbuntuUsing XMLHttpRequest, an attacker could have identified installed applications by probing error...6.5 MediumfirefoxUbuntuWhen invoking protocol handlers for external protocols, a supplied parameter URL containing...6.5 MediumfirefoxUbuntuWebExtensions with the correct permissions were able to create and install ServiceWorkers for...6.5 MediumfirefoxUbuntuFailure to correctly record the location of live pointers across wasm instance calls resulted in...8.8 HighfirefoxUbuntuBy misusing a race in our notification code, an attacker could have forcefully hidden the...4.3 MediumfirefoxUbuntuAn incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt...8.8 HighfirefoxUbuntuUnder certain circumstances, asynchronous functions could have caused a navigation to fail but...6.5 MediumfirefoxUbuntuDue to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with...4.3 MediumfirefoxUbuntuBy displaying a form validity message in the correct location at the same time as a permission...4.3 MediumfirefoxUbuntuThe Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently...6.5 MediumfirefoxUbuntuThrough a series of navigations, Firefox could have entered fullscreen mode without notification...4.3 MediumfirefoxUbuntuWhen interacting with an HTML input element's file picker dialog with webkitdirectory set, a use...8.8 HighfirefoxUbuntuThe iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to...10.0 CriticalfirefoxUbuntuMozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some...8.8 HighfirefoxUbuntuMozilla developers reported memory safety bugs present in Firefox 92. Some of these bugs showed...8.8 HighfirefoxUbuntuDuring process shutdown, a document could have caused a use-after-free of a languages service...7.5 HighfirefoxUbuntuThrough use of reportValidity() and window.open(), a plain-text validation message could have...6.5 MediumfirefoxUbuntuMozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some...8.8 HighfirefoxUbuntuDuring operations on MessageTasks, a task may have been removed while it was still scheduled,...8.8 HighfirefoxUbuntuMozilla developers reported memory safety bugs present in Firefox 91. Some of these bugs showed...8.8 HighfirefoxUbuntuMixed-content checks were unable to analyze opaque origins which led to some mixed content being...6.5 MediumfirefoxUbuntuMozilla developers reported memory safety bugs present in Firefox 91 and Firefox ESR 78.13. Some...8.8 HighfirefoxUbuntufirefox regressionNo scorefirefoxUbuntuFirefox incorrectly accepted a newline in a HTTP/3 header, interpretting it as two separate...8.1 HighfirefoxUbuntuMozilla developers and community members reported memory safety bugs present in Firefox 90. Some...8.8 HighfirefoxUbuntuMozilla developers reported memory safety bugs present in Firefox 90 and Firefox ESR 78.12. Some...8.8 HighfirefoxUbuntuFirefox incorrectly treated an inline list-item element as a block element, resulting in an out...8.8 HighfirefoxUbuntuAfter requesting multiple permissions, and closing the first permission panel, subsequent...6.5 MediumfirefoxUbuntuA suspected race condition when calling getaddrinfo led to memory corruption and a potentially...8.1 HighfirefoxUbuntuA use-after-free vulnerability in media channels could have led to memory corruption and a...8.8 HighfirefoxUbuntuInstruction reordering resulted in a sequence of instructions that would cause an object to be...8.8 HighfirefoxUbuntuDue to incorrect JIT optimization, we incorrectly interpreted data from the wrong type of object,...6.5 MediumfirefoxUbuntuAn issue present in lowering/register allocation could have led to obscure but deterministic...8.8 HighfirefoxUbuntuUninitialized memory in a canvas object could have caused an incorrect free() leading to memory...8.8 HighfirefoxUbuntuData race in crossbeam-deque9.8 CriticalfirefoxUbuntuMozilla developers reported memory safety bugs present in Firefox 89. Some of these bugs showed...8.8 HighfirefoxUbuntuThrough a series of DOM manipulations, a message, over which the attacker had control of the text...6.5 MediumfirefoxUbuntuWhen network partitioning was enabled, e.g. as a result of Enhanced Tracking Protection settings,...4.3 Medium- Show moreLoading…