Product:

Firefox

(Mozilla)
Repositories • https://github.com/libevent/libevent
• https://github.com/khaledhosny/ots
#Vulnerabilities 2708
Date Id Summary Products Score Patch Annotated
2023-06-02 CVE-2023-29537 Multiple race conditions in the font initialization could have led to memory corruption and execution of attacker-controlled code. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112. Firefox, Focus 7.5
2023-06-02 CVE-2023-29538 Under specific circumstances a WebExtension may have received a <code>jar:file:///</code> URI instead of a <code>moz-extension:///</code> URI during a load request. This leaked directory paths on the user's machine. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112. Firefox, Focus 4.3
2023-06-02 CVE-2023-29539 When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. Firefox, Firefox_esr, Focus, Thunderbird 8.8
2023-06-02 CVE-2023-29540 Using a redirect embedded into <code>sourceMappingUrls</code> could allow for navigation to external protocol links in sandboxed iframes without <code>allow-top-navigation-to-custom-protocols</code>. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112. Firefox, Focus 6.1
2023-06-02 CVE-2023-32205 In multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to potential user confusion and spoofing attacks. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. Firefox, Firefox_esr, Thunderbird 4.3
2023-06-02 CVE-2023-32206 An out-of-bound read could have led to a crash in the RLBox Expat driver. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. Firefox, Firefox_esr, Thunderbird 6.5
2023-06-02 CVE-2023-32211 A type checking bug would have led to invalid code being compiled. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. Firefox, Firefox_esr, Thunderbird 6.5
2023-06-02 CVE-2023-32213 When reading a file, an uninitialized value could have been used as read limit. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. Firefox, Firefox_esr, Thunderbird 8.8
2023-06-19 CVE-2023-34415 When choosing a site-isolated process for a document loaded from a data: URL that was the result of a redirect, Firefox would load that document in the same process as the site that issued the redirect. This bypassed the site-isolation protections against Spectre-like attacks on sites that host an "open redirect". Firefox no longer follows HTTP redirects to data: URLs. This vulnerability affects Firefox < 114. Firefox 6.1
2023-06-19 CVE-2023-32208 Service workers could reveal script base URL due to dynamic `import()`. This vulnerability affects Firefox < 113. Firefox 5.3