Debian Firefox vulnerabilities

CVE-2023-4863 [HIGH] CVE-2023-4863: chromium - Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and lib... Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical) Scope: local bookworm: resolved (fixed in 117.0.5938.62-1) bullseye: resolved (fixed in 117.0.5938.62-1) forky: resolved (fixed in 117.0.5938.62-1)

CVE-2016-9079 [HIGH] CVE-2016-9079: firefox - A use-after-free vulnerability in SVG Animation has been discovered. An exploit ... A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1. Scope: local sid: resolved (fixed in 50.0.2-1)

CVE-2019-11708 [CRITICAL] CVE-2019-11708: firefox - Insufficient vetting of parameters passed with the Prompt:Open IPC message betwe... Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. This vulnerability affects Firef

CVE-2023-5217 [HIGH] CVE-2023-5217: chromium - Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5... Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Scope: local bookworm: resolved (fixed in 117.0.5938.132-1~deb12u1) bullseye: resolved (fixed in 117.0.5938.132-1~deb11u1) forky: resolved

CVE-2019-17026 [HIGH] CVE-2019-17026: firefox - Incorrect alias information in IonMonkey JIT compiler for setting array elements... Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox < 72.0.1. Scope: local sid: resolved (fixed in 72.0.1-1)

CVE-2019-11707 [HIGH] CVE-2019-11707: firefox - A type confusion vulnerability can occur when manipulating JavaScript objects du... A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2. Scope: local sid: resolved (fixed in 67.0.3-1)

CVE-2022-26485 [HIGH] CVE-2022-26485: firefox - Removing an XSLT parameter during processing could have lead to an exploitable u... Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0. Scope: local sid: resolved (fixed in 99.0-1)

CVE-2024-9680 [CRITICAL] CVE-2024-9680: firefox - An attacker was able to achieve code execution in the content process by exploit... An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0. Sco

CVE-2022-26486 [CRITICAL] CVE-2022-26486: firefox - An unexpected message in the WebGPU IPC framework could lead to a use-after-free... An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0. Scope: local sid: resolved (fixed in 99.0-1)

CVE-2020-6820 [HIGH] CVE-2020-6820: firefox - Under certain conditions, when handling a ReadableStream, a race condition can c... Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1. Scope: local sid: resolved (fixed in 74.0.1-1)

CVE-2020-6819 [HIGH] CVE-2020-6819: firefox - Under certain conditions, when running the nsDocShell destructor, a race conditi... Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1. Scope: local sid: resolved (fixed in 74.0.1-1)

CVE-2006-3677 [HIGH] CVE-2006-3677: firefox - Mozilla Firefox 1.5 before 1.5.0.5 and SeaMonkey before 1.0.3 allows remote atta... Mozilla Firefox 1.5 before 1.5.0.5 and SeaMonkey before 1.0.3 allows remote attackers to execute arbitrary code by changing certain properties of the window navigator object (window.navigator) that are accessed when Java starts up, which causes a crash that leads to code execution. Scope: local sid: resolved (fixed in 1.5.dfsg+1.5.0.5-1)

CVE-2019-9810 [HIGH] CVE-2019-9810: firefox - Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice ... Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow. This vulnerability affects Firefox < 66.0.1, Firefox ESR < 60.6.1, and Thunderbird < 60.6.1. Scope: local sid: resolved (fixed in 66.0.1-1)

CVE-2022-1802 [HIGH] CVE-2022-1802: firefox - If an attacker was able to corrupt the methods of an Array object in JavaScript ... If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code in a privileged context. This vulnerability affects Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0, and Thunderbird < 91.9.1. Scope: local sid: resolved (fixed in 100.

CVE-2022-28281 [HIGH] CVE-2022-28281: firefox - If a compromised content process sent an unexpected number of WebAuthN Extension... If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent process, an out of bounds write would have occurred leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8. Scope: local sid: resolved (fixed in 99.0-1)

CVE-2022-1529 [HIGH] CVE-2022-1529: firefox - An attacker could have sent a message to the parent process where the contents w... An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading to prototype pollution and ultimately attacker-controlled JavaScript executing in the privileged parent process. This vulnerability affects Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0, and Thunderbird < 9

CVE-2020-15654 [MEDIUM] CVE-2020-15654: firefox - When in an endless loop, a website specifying a custom cursor using CSS could ma... When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interface, when they are not. This could lead to a perceived broken state, especially when interactions with existing browser dialogs and warnings do not work. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunder

CVE-2019-11695 [MEDIUM] CVE-2019-11695: firefox - A custom cursor defined by scripting on a site can position itself over the addr... A custom cursor defined by scripting on a site can position itself over the addressbar to spoof the actual cursor when it should not be allowed outside of the primary web content area. This could be used by a malicious site to trick users into clicking on permission prompts, doorhanger notifications, or other buttons inadvertently if the location is spoofed over t

CVE-2022-1097 [MEDIUM] CVE-2022-1097: firefox - <code>NSSToken</code> objects were referenced via direct points, and could have ... NSSToken objects were referenced via direct points, and could have been accessed in an unsafe way on different threads, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8. Scope: local sid: resolved (fixed in 99.0-1)

CVE-2019-9806 [HIGH] CVE-2019-9806: firefox - A vulnerability exists during authorization prompting for FTP transaction where ... A vulnerability exists during authorization prompting for FTP transaction where successive modal prompts are displayed and cannot be immediately dismissed. This allows for a denial of service (DOS) attack. This vulnerability affects Firefox < 66. Scope: local sid: resolved (fixed in 66.0-1)