firefox vulnerabilities (Ubuntu)
1,530 vulnerabilities.
firefoxUbuntuThe sourceMapURL feature in devtools was missing security checks that would have allowed a...6.5 MediumfirefoxUbuntuMozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the...8.8 HighfirefoxUbuntuDue to a layout change, iframe contents could have been rendered outside of its border. This...5.4 MediumfirefoxUbuntuWhen generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect...6.5 MediumfirefoxUbuntuBy using a link with <code>rel="localization"</code> a use-after-free could have been triggered...6.5 MediumfirefoxUbuntuIf a compromised content process sent an unexpected number of WebAuthN Extensions in a Register...8.8 HighfirefoxUbuntuAfter a VR Process is destroyed, a reference to it may have been retained and used, leading to a...6.5 MediumfirefoxUbuntu<code>NSSToken</code> objects were referenced via direct points, and could have been accessed in...6.5 MediumfirefoxUbuntuUse after free in Wasmtime8.1 HighfirefoxUbuntufirefox regressionsNo scorefirefoxUbuntuIn unusual circumstances, an individual thread may outlive the thread's manager during shutdown....6.5 MediumfirefoxUbuntuWhile the text displayed in Autofill tooltips cannot be directly read by JavaScript, the text was...4.3 MediumfirefoxUbuntuMozilla developers Kershaw Chang, Ryan VanderMeulen, and Randell Jesup reported memory safety...8.8 HighfirefoxUbuntuWhen installing an add-on, Firefox verified the signature before prompting the user; but while...7.5 HighfirefoxUbuntuIf an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code>...9.6 CriticalfirefoxUbuntuWhen resizing a popup after requesting fullscreen access, the popup would not display the...4.3 MediumfirefoxUbuntuAn attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading...8.8 HighfirefoxUbuntuRegular expression denial of service in Rust's regex crate7.5 HighfirefoxUbuntuAn unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable...9.6 CriticalfirefoxUbuntuRemoving an XSLT parameter during processing could have lead to an exploitable use-after-free. We...8.8 HighfirefoxUbuntuIn Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.7.5 HighfirefoxUbuntuIn Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.9.8 CriticalfirefoxUbuntuIn Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via...6.5 MediumfirefoxUbuntuxmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator...9.8 CriticalfirefoxUbuntuxmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as...9.8 CriticalfirefoxUbuntuMozilla developers Paul Adenot and the Mozilla Fuzzing Team reported memory safety bugs present...8.8 HighfirefoxUbuntuWeb-accessible extension pages (pages with a moz-extension:// scheme) were not correctly...8.8 HighfirefoxUbuntuWhen importing resources using Web Workers, error messages would distinguish the difference...6.5 MediumfirefoxUbuntuIf a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently...9.6 CriticalfirefoxUbuntuRemote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have...6.5 MediumfirefoxUbuntuIf a user was convinced to drag and drop an image to their desktop or other folder, the resulting...8.8 HighfirefoxUbuntuBy using XSL Transforms, a malicious webserver could have served a user an XSL document that...8.8 HighfirefoxUbuntuIf a user installed an extension of a particular type, the extension could have auto-updated...6.5 MediumfirefoxUbuntuMozilla developers and community members Gabriele Svelto, Sebastian Hengst, Randell Jesup, Luan...8.8 HighfirefoxUbuntuImproper Restriction of Operations within the Bounds of a Memory Buffer and Race Condition in crossbeam-utils8.1 HighfirefoxUbuntuExpat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.7.5 HighfirefoxUbuntuExpat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for...9.8 CriticalfirefoxUbuntuMozilla developers Christian Holler and Jason Kratzer reported memory safety bugs present in...8.8 HighfirefoxUbuntuMozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele...8.8 HighfirefoxUbuntuMalicious websites could have confused Firefox into showing the wrong origin when asking to...6.5 MediumfirefoxUbuntuAfter accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the...6.5 MediumfirefoxUbuntuSecuritypolicyviolation events could have leaked cross-origin information for frame-ancestors...6.5 MediumfirefoxUbuntuWhen navigating from inside an iframe while requesting fullscreen access, an attacker-controlled...4.3 MediumfirefoxUbuntuWhen inserting text while in edit mode, some characters might have lead to out-of-bounds memory...6.5 MediumfirefoxUbuntuWhen resizing a popup while requesting fullscreen access, the popup would have become unable to...7.5 HighfirefoxUbuntuCertain network request objects were freed too early when releasing a network request handle....8.8 HighfirefoxUbuntuMalicious websites could have tricked users into accepting launching a program to handle an...6.5 MediumfirefoxUbuntuApplying a CSS filter effect could have accessed out of bounds memory. This could have lead to a...8.8 HighfirefoxUbuntuConstructing audio sinks could have lead to a race condition when playing audio files and closing...7.5 HighfirefoxUbuntuaddBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.9.8 Critical- Show moreLoading…