Debian Firefox vulnerabilities

CVE-2021-23971 [MEDIUM] CVE-2021-23971: firefox - When processing a redirect with a conflicting Referrer-Policy, Firefox would hav... When processing a redirect with a conflicting Referrer-Policy, Firefox would have adopted the redirect's Referrer-Policy. This would have potentially resulted in more information than intended by the original origin being provided to the destination of the redirect. This vulnerability affects Firefox < 86. Scope: local sid: resolved (fixed in 86.0-1)

CVE-2021-23958 [MEDIUM] CVE-2021-23958: firefox - The browser could have been confused into transferring a screen sharing state in... The browser could have been confused into transferring a screen sharing state into another tab, which would leak unintended information. This vulnerability affects Firefox < 85. Scope: local sid: resolved (fixed in 85.0-1)

CVE-2021-38491 [MEDIUM] CVE-2021-38491: firefox - Mixed-content checks were unable to analyze opaque origins which led to some mix... Mixed-content checks were unable to analyze opaque origins which led to some mixed content being loaded. This vulnerability affects Firefox < 92. Scope: local sid: resolved (fixed in 92.0-1)

CVE-2019-11699 [MEDIUM] CVE-2019-11699: firefox - A malicious page can briefly cause the wrong name to be highlighted as the domai... A malicious page can briefly cause the wrong name to be highlighted as the domain name in the addressbar during page navigations. This could result in user confusion of which site is currently loaded for spoofing attacks. This vulnerability affects Firefox < 67. Scope: local sid: resolved (fixed in 67.0-2)

CVE-2020-26967 [MEDIUM] CVE-2020-26967: firefox - When listening for page changes with a Mutation Observer, a malicious web page c... When listening for page changes with a Mutation Observer, a malicious web page could confuse Firefox Screenshots into interacting with elements other than those that it injected into the page. This would lead to internal errors and unexpected behavior in the Screenshots code. This vulnerability affects Firefox < 83. Scope: local sid: resolved (fixed in 83.0-1)

CVE-2020-12408 [MEDIUM] CVE-2020-12408: firefox - When browsing a document hosted on an IP address, an attacker could insert certa... When browsing a document hosted on an IP address, an attacker could insert certain characters to flip domain and path information in the address bar. This vulnerability affects Firefox < 77. Scope: local sid: resolved (fixed in 77.0-1)

CVE-2021-23983 [MEDIUM] CVE-2021-23983: firefox - By causing a transition on a parent node by removing a CSS rule, an invalid prop... By causing a transition on a parent node by removing a CSS rule, an invalid property for a marker could have been applied, resulting in memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 87. Scope: local sid: resolved (fixed in 87.0-1)

CVE-2022-42929 [MEDIUM] CVE-2022-42929: firefox - If a website called `window.print()` in a particular way, it could cause a denia... If a website called `window.print()` in a particular way, it could cause a denial of service of the browser, which may persist beyond browser restart depending on the user's session restore settings. This vulnerability affects Firefox < 106, Firefox ESR < 102.4, and Thunderbird < 102.4. Scope: local sid: resolved (fixed in 106.0-1)

CVE-2020-15677 [MEDIUM] CVE-2020-15677: firefox - By exploiting an Open Redirect vulnerability on a website, an attacker could hav... By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original site (the one suffering from the open redirect) rather than the site the file was actually downloaded from. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3. Scope: local si

CVE-2020-15676 [MEDIUM] CVE-2020-15676: firefox - Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer... Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attacker-controlled data into a contenteditable element. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3. Scope: local sid: resolved (fixed in 81.0-1)

CVE-2022-28287 [MEDIUM] CVE-2022-28287: firefox - In unusual circumstances, selecting text could cause text selection caching to b... In unusual circumstances, selecting text could cause text selection caching to behave incorrectly, leading to a crash. This vulnerability affects Firefox < 99. Scope: local sid: resolved (fixed in 99.0-1)

CVE-2023-4578 [MEDIUM] CVE-2023-4578: firefox - When calling `JS::CheckRegExpSyntax` a Syntax Error could have been set which wo... When calling `JS::CheckRegExpSyntax` a Syntax Error could have been set which would end in calling `convertToRuntimeErrorAndClear`. A path in the function could attempt to allocate memory when none is available which would have caused a newly created Out of Memory exception to be mishandled as a Syntax Error. This vulnerability affects Firefox < 117, Firefox ESR < 1

CVE-2018-5175 [MEDIUM] CVE-2018-5175: firefox - A mechanism to bypass Content Security Policy (CSP) protections on sites that ha... A mechanism to bypass Content Security Policy (CSP) protections on sites that have a "script-src" policy of "'strict-dynamic'". If a target website contains an HTML injection flaw an attacker could inject a reference to a copy of the "require.js" library that is part of Firefox's Developer Tools, and then use a known technique using that library to bypass the CSP re

CVE-2018-5176 [MEDIUM] CVE-2018-5176: firefox - The JSON Viewer displays clickable hyperlinks for strings that are parseable as ... The JSON Viewer displays clickable hyperlinks for strings that are parseable as URLs, including "javascript:" links. If a JSON file contains malicious JavaScript script embedded as "javascript:" links, users may be tricked into clicking and running this code in the context of the JSON Viewer. This can allow for the theft of cookies and authorization tokens which are

CVE-2020-26951 [MEDIUM] CVE-2020-26951: firefox - A parsing and event loading mismatch in Firefox's SVG code could have allowed lo... A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization. An attacker already capable of exploiting an XSS vulnerability in privileged internal pages could have used this attack to bypass our built-in sanitizer. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. Sco

CVE-2018-5124 [MEDIUM] CVE-2018-5124: firefox - Unsanitized output in the browser UI leaves HTML tags in place and can result in... Unsanitized output in the browser UI leaves HTML tags in place and can result in arbitrary code execution in Firefox before version 58.0.1. Scope: local sid: resolved (fixed in 58.0.1-1)

CVE-2017-5462 [MEDIUM] CVE-2017-5462: firefox - A flaw in DRBG number generation within the Network Security Services (NSS) libr... A flaw in DRBG number generation within the Network Security Services (NSS) library where the internal state V does not correctly carry bits over. The NSS library has been updated to fix this issue to address this issue and Firefox ESR 52.1 has been updated with NSS version 3.28.4. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1

CVE-2022-45411 [MEDIUM] CVE-2022-45411: firefox - Cross-Site Tracing occurs when a server will echo a request back via the Trace m... Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization headers and cookies inaccessible to JavaScript (such as cookies protected by HTTPOnly). To mitigate this attack, browsers placed limits on fetch() and XMLHttpRequest; however some webservers have implemented non-standard headers

CVE-2024-10461 [MEDIUM] CVE-2024-10461: firefox - In multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the... In multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the response header was not respected and did not force a download, which could allow XSS attacks. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132. Scope: local sid: resolved (fixed in 132.0-1)

CVE-2022-29911 [MEDIUM] CVE-2022-29911: firefox - An improper implementation of the new iframe sandbox keyword <code>allow-top-nav... An improper implementation of the new iframe sandbox keyword allow-top-navigation-by-user-activation could lead to script execution without allow-scripts being present. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. Scope: local sid: resolved (fixed in 100.0-1)