Debian Firefox vulnerabilities

CVE-2023-6860 [MEDIUM] CVE-2023-6860: firefox - The `VideoBridge` allowed any content process to use textures produced by remote... The `VideoBridge` allowed any content process to use textures produced by remote decoders. This could be abused to escape the sandbox. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121. Scope: local sid: resolved (fixed in 121.0-1)

CVE-2006-2788 [HIGH] CVE-2006-2788: firefox - Double free vulnerability in the getRawDER function for nsIX509Cert in Firefox a... Double free vulnerability in the getRawDER function for nsIX509Cert in Firefox allows remote attackers to cause a denial of service (hang) and possibly execute arbitrary code via certain Javascript code. Scope: local sid: resolved (fixed in 1.5.dfsg+1.5.0.4)

CVE-2023-6204 [MEDIUM] CVE-2023-6204: firefox - On some systems—depending on the graphics settings and drivers—it was possible t... On some systems—depending on the graphics settings and drivers—it was possible to force an out-of-bounds read and leak memory data into the images created on the canvas element. This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5. Scope: local sid: resolved (fixed in 120.0-1)

CVE-2021-38507 [MEDIUM] CVE-2021-38507: firefox - The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to ... The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently upgraded to TLS while retaining the visual properties of an HTTP connection, including being same-origin with unencrypted connections on port 80. However, if a second encrypted port on the same IP address (e.g. port 8443) did not opt-in to opportunistic encryption; a n

CVE-2022-28285 [MEDIUM] CVE-2022-28285: firefox - When generating the assembly code for <code>MLoadTypedArrayElementHole</code>, a... When generating the assembly code for MLoadTypedArrayElementHole, an incorrect AliasSet was used. In conjunction with another vulnerability this could have been used for an out of bounds memory read. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8. Scope: local sid: resolved (fixed in 99.0-1)

CVE-2022-34479 [MEDIUM] CVE-2022-34479: firefox - A malicious website that could create a popup could have resized the popup to ov... A malicious website that could create a popup could have resized the popup to overlay the address bar with its own content, resulting in potential user confusion or spoofing attacks. *This bug only affects Thunderbird for Linux. Other operating systems are unaffected.*. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbi

CVE-2024-10463 [MEDIUM] CVE-2024-10463: firefox - Video frames could have been leaked between origins in some situations. This vul... Video frames could have been leaked between origins in some situations. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firefox ESR < 115.17, Thunderbird < 128.4, and Thunderbird < 132. Scope: local sid: resolved (fixed in 132.0-1)

CVE-2023-29548 [MEDIUM] CVE-2023-29548: firefox - A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optim... A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. Scope: local sid: resolved (fixed in 112.0-1)

CVE-2022-22739 [MEDIUM] CVE-2022-22739: firefox - Malicious websites could have tricked users into accepting launching a program t... Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. Scope: local sid: resolved (fixed in 96.0-1)

CVE-2023-25728 [MEDIUM] CVE-2023-25728: firefox - The <code>Content-Security-Policy-Report-Only</code> header could allow an attac... The Content-Security-Policy-Report-Only header could allow an attacker to leak a child iframe's unredacted URI when interaction with that iframe triggers a redirect. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. Scope: local sid: resolved (fixed in 110.0-1)

CVE-2022-46880 [MEDIUM] CVE-2022-46880: firefox - A missing check related to tex units could have led to a use-after-free and pote... A missing check related to tex units could have led to a use-after-free and potentially exploitable crash.*Note*: This advisory was added on December 13th, 2022 after we better understood the impact of the issue. The fix was included in the original release of Firefox 105. This vulnerability affects Firefox ESR < 102.6, Firefox < 105, and Thunderbird < 102.6. Scop

CVE-2022-22754 [MEDIUM] CVE-2022-22754: firefox - If a user installed an extension of a particular type, the extension could have ... If a user installed an extension of a particular type, the extension could have auto-updated itself and while doing so, bypass the prompt which grants the new version the new requested permissions. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. Scope: local sid: resolved (fixed in 97.0-1)

CVE-2023-23603 [MEDIUM] CVE-2023-23603: firefox - Regular expressions used to filter out forbidden properties and values from styl... Regular expressions used to filter out forbidden properties and values from style directives in calls to `console.log` weren't accounting for external URLs. Data could then be potentially exfiltrated from the browser. This vulnerability affects Firefox < 109, Firefox ESR < 102.7, and Thunderbird < 102.7. Scope: local sid: resolved (fixed in 109.0-1)

CVE-2022-45404 [MEDIUM] CVE-2022-45404: firefox - Through a series of popup and <code>window.print()</code> calls, an attacker can... Through a series of popup and window.print() calls, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. Scope: local sid: resolved (fixed in 107.0-1)

CVE-2023-23602 [MEDIUM] CVE-2023-23602: firefox - A mishandled security check when creating a WebSocket in a WebWorker caused the ... A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored. This could lead to connections to restricted origins from inside WebWorkers. This vulnerability affects Firefox < 109, Firefox ESR < 102.7, and Thunderbird < 102.7. Scope: local sid: resolved (fixed in 109.0-1)

CVE-2024-0747 [MEDIUM] CVE-2024-0747: firefox - When a parent page loaded a child in an iframe with `unsafe-inline`, the parent ... When a parent page loaded a child in an iframe with `unsafe-inline`, the parent Content Security Policy could have overridden the child Content Security Policy. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7. Scope: local sid: resolved (fixed in 122.0-1)

CVE-2024-10464 [MEDIUM] CVE-2024-10464: firefox - Repeated writes to history interface attributes could have been used to cause a ... Repeated writes to history interface attributes could have been used to cause a Denial of Service condition in the browser. This was addressed by introducing rate-limiting to this API. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132. Scope: local sid: resolved (fixed in 132.0-1)

CVE-2023-37206 [MEDIUM] CVE-2023-37206: firefox - Uploading files which contain symlinks may have allowed an attacker to trick a u... Uploading files which contain symlinks may have allowed an attacker to trick a user into submitting sensitive data to a malicious website. This vulnerability affects Firefox < 115. Scope: local sid: resolved (fixed in 115.0-1)

CVE-2022-28283 [MEDIUM] CVE-2022-28283: firefox - The sourceMapURL feature in devtools was missing security checks that would have... The sourceMapURL feature in devtools was missing security checks that would have allowed a webpage to attempt to include local files or other files that should have been inaccessible. This vulnerability affects Firefox < 99. Scope: local sid: resolved (fixed in 99.0-1)

CVE-2023-4577 [MEDIUM] CVE-2023-4577: firefox - When `UpdateRegExpStatics` attempted to access `initialStringHeap` it could alre... When `UpdateRegExpStatics` attempted to access `initialStringHeap` it could already have been garbage collected prior to entering the function, which could potentially have led to an exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2. Scope: local sid: resolved (fixed in 117.0-1)