Debian Firefox vulnerabilities

CVE-2022-29911 [MEDIUM] CVE-2022-29911: firefox - An improper implementation of the new iframe sandbox keyword <code>allow-top-nav... An improper implementation of the new iframe sandbox keyword allow-top-navigation-by-user-activation could lead to script execution without allow-scripts being present. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. Scope: local sid: resolved (fixed in 100.0-1)

CVE-2024-4768 [MEDIUM] CVE-2024-4768: firefox - A bug in popup notifications' interaction with WebAuthn made it easier for an at... A bug in popup notifications' interaction with WebAuthn made it easier for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11. Scope: local sid: resolved (fixed in 126.0-1)

CVE-2024-1549 [MEDIUM] CVE-2024-1549: firefox - If a website set a large custom cursor, portions of the cursor could have overla... If a website set a large custom cursor, portions of the cursor could have overlapped with the permission dialog, potentially resulting in user confusion and unexpected granted permissions. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. Scope: local sid: resolved (fixed in 123.0-1)

CVE-2016-9064 [MEDIUM] CVE-2016-9064: firefox - Add-on updates failed to verify that the add-on ID inside the signed package mat... Add-on updates failed to verify that the add-on ID inside the signed package matched the ID of the add-on being updated. An attacker who could perform a man-in-the-middle attack on the user's connection to the update server and defeat the certificate pinning protection could provide a malicious signed add-on instead of a valid update. This vulnerability affects Fire

CVE-2024-7524 [MEDIUM] CVE-2024-7524: firefox - Firefox adds web-compatibility shims in place of some tracking scripts blocked b... Firefox adds web-compatibility shims in place of some tracking scripts blocked by Enhanced Tracking Protection. On a site protected by Content Security Policy in "strict-dynamic" mode, an attacker able to inject an HTML element could have used a DOM Clobbering attack on some of the shims and achieved XSS, bypassing the CSP strict-dynamic protection. This vulnerabili

CVE-2024-11694 [MEDIUM] CVE-2024-11694: firefox - Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP ... Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and DOM-based XSS through the Google SafeFrame shim in the Web Compatibility extension. This issue could have exposed users to malicious frames masquerading as legitimate content. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Firefox ESR < 115.18, Th

CVE-2025-13013 [MEDIUM] CVE-2025-13013: firefox - Mitigation bypass in the DOM: Core & HTML component. This vulnerability affects ... Mitigation bypass in the DOM: Core & HTML component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Firefox ESR < 115.30, Thunderbird < 145, and Thunderbird < 140.5. Scope: local sid: resolved (fixed in 145.0-1)

CVE-2024-4772 [MEDIUM] CVE-2024-4772: firefox - An HTTP digest authentication nonce value was generated using `rand()` which cou... An HTTP digest authentication nonce value was generated using `rand()` which could lead to predictable values. This vulnerability affects Firefox < 126. Scope: local sid: resolved (fixed in 126.0-1)

CVE-2018-5165 [MEDIUM] CVE-2018-5165: firefox - In 32-bit versions of Firefox, the Adobe Flash plugin setting for "Enable Adobe ... In 32-bit versions of Firefox, the Adobe Flash plugin setting for "Enable Adobe Flash protected mode" is unchecked by default even though the Adobe Flash sandbox is actually enabled. The displayed state is the reverse of the true setting, resulting in user confusion. This could cause users to select this setting intending to activate it and inadvertently turn protec

CVE-2017-7831 [MEDIUM] CVE-2017-7831: firefox - A vulnerability where the security wrapper does not deny access to some exposed ... A vulnerability where the security wrapper does not deny access to some exposed properties using the deprecated "_exposedProps_" mechanism on proxy objects. These properties should be explicitly unavailable to proxy objects. This vulnerability affects Firefox < 57. Scope: local sid: resolved (fixed in 57.0-1)

CVE-2024-2611 [MEDIUM] CVE-2024-2611: firefox - A missing delay on when pointer lock was used could have allowed a malicious pag... A missing delay on when pointer lock was used could have allowed a malicious page to trick a user into granting permissions. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9. Scope: local sid: resolved (fixed in 124.0-1)

CVE-2019-11761 [MEDIUM] CVE-2019-11761: firefox - By using a form with a data URI it was possible to gain access to the privileged... By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact from exposing this object appears to be minimal, however it was a bypass of existing defense in depth mechanisms. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. Scope: local sid: resolved (

CVE-2023-5722 [MEDIUM] CVE-2023-5722: firefox - Using iterative requests an attacker was able to learn the size of an opaque res... Using iterative requests an attacker was able to learn the size of an opaque response, as well as the contents of a server-supplied Vary header. This vulnerability affects Firefox < 119. Scope: local sid: resolved (fixed in 119.0-1)

CVE-2023-4045 [MEDIUM] CVE-2023-4045: firefox - Offscreen Canvas did not properly track cross-origin tainting, which could have ... Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from another site in violation of same-origin policy. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. Scope: local sid: resolved (fixed in 116.0-1)

CVE-2024-11696 [MEDIUM] CVE-2024-11696: firefox - The application failed to account for exceptions thrown by the `loadManifestFrom... The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have caused runtime errors that disrupted the signature validation process. As a result, the enforcement of signature validation for unrelated add-ons may have

CVE-2026-0890 [MEDIUM] CVE-2026-0890: firefox - Spoofing issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerab... Spoofing issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability affects Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7. Scope: local sid: resolved (fixed in 147.0-1)

CVE-2026-0883 [MEDIUM] CVE-2026-0883: firefox - Information disclosure in the Networking component. This vulnerability affects F... Information disclosure in the Networking component. This vulnerability affects Firefox < 147, Firefox ESR < 140.7, Thunderbird < 147, and Thunderbird < 140.7. Scope: local sid: resolved (fixed in 147.0-1)

CVE-2016-5292 [MEDIUM] CVE-2016-5292: firefox - During URL parsing, a maliciously crafted URL can cause a potentially exploitabl... During URL parsing, a maliciously crafted URL can cause a potentially exploitable crash. This vulnerability affects Firefox < 50. Scope: local sid: resolved (fixed in 50.0-1)

CVE-2018-5169 [MEDIUM] CVE-2018-5169: firefox - If manipulated hyperlinked text with "chrome:" URL contained in it is dragged an... If manipulated hyperlinked text with "chrome:" URL contained in it is dragged and dropped on the "home" icon, the home page can be reset to include a normally-unlinkable chrome page as one of the home page tabs. This vulnerability affects Firefox < 60. Scope: local sid: resolved (fixed in 60.0-1)

CVE-2019-17022 [MEDIUM] CVE-2019-17022: firefox - When pasting a &lt;style&gt; tag from the clipboard into a rich text editor, the... When pasting a tag from the clipboard into a rich text editor, the CSS sanitizer does not escape characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently copies the node's innerHTML, assigning it to another innerHTML, this would resu