Debian Firefox vulnerabilities

CVE-2018-5169 [MEDIUM] CVE-2018-5169: firefox - If manipulated hyperlinked text with "chrome:" URL contained in it is dragged an... If manipulated hyperlinked text with "chrome:" URL contained in it is dragged and dropped on the "home" icon, the home page can be reset to include a normally-unlinkable chrome page as one of the home page tabs. This vulnerability affects Firefox < 60. Scope: local sid: resolved (fixed in 60.0-1)

CVE-2019-17022 [MEDIUM] CVE-2019-17022: firefox - When pasting a &lt;style&gt; tag from the clipboard into a rich text editor, the... When pasting a tag from the clipboard into a rich text editor, the CSS sanitizer does not escape characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently copies the node's innerHTML, assigning it to another innerHTML, this would resu

CVE-2006-3803 [MEDIUM] CVE-2006-3803: firefox - Race condition in the JavaScript garbage collection in Mozilla Firefox 1.5 befor... Race condition in the JavaScript garbage collection in Mozilla Firefox 1.5 before 1.5.0.5, Thunderbird before 1.5.0.5, and SeaMonkey before 1.0.3 might allow remote attackers to execute arbitrary code by causing the garbage collector to delete a temporary variable while it is still being used during the creation of a new Function object. Scope: local sid: resolved (

CVE-2021-43543 [MEDIUM] CVE-2021-43543: firefox - Documents loaded with the CSP sandbox directive could have escaped the sandbox's... Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. Scope: local sid: resolved (fixed in 95.0-1)

CVE-2017-7799 [MEDIUM] CVE-2017-7799: firefox - JavaScript in the "about:webrtc" page is not sanitized properly being assigned t... JavaScript in the "about:webrtc" page is not sanitized properly being assigned to "innerHTML". Data on this page is supplied by WebRTC usage and is not under third-party control, making this difficult to exploit, but the vulnerability could possibly be used for a cross-site scripting (XSS) attack. This vulnerability affects Firefox < 55. Scope: local sid: resolved (

CVE-2018-5124 [MEDIUM] CVE-2018-5124: firefox - Unsanitized output in the browser UI leaves HTML tags in place and can result in... Unsanitized output in the browser UI leaves HTML tags in place and can result in arbitrary code execution in Firefox before version 58.0.1. Scope: local sid: resolved (fixed in 58.0.1-1)

CVE-2022-40956 [MEDIUM] CVE-2022-40956: firefox - When injecting an HTML base element, some requests would ignore the CSP's base-u... When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. Scope: local sid: resolved (fixed in 105.0-1)

CVE-2017-5389 [MEDIUM] CVE-2017-5389: firefox - WebExtensions could use the "mozAddonManager" API by modifying the CSP headers o... WebExtensions could use the "mozAddonManager" API by modifying the CSP headers on sites with the appropriate permissions and then using host requests to redirect script loads to a malicious site. This allows a malicious extension to then install additional extensions without explicit user permission. This vulnerability affects Firefox < 51. Scope: local sid: resolve

CVE-2022-45418 [MEDIUM] CVE-2022-45418: firefox - If a custom mouse cursor is specified in CSS, under certain circumstances the cu... If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the browser UI, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. Scope: local sid: resolved (fixed in 107.0-1)

CVE-2021-23974 [MEDIUM] CVE-2021-23974: firefox - The DOMParser API did not properly process '<noscript>' elements for escaping. T... The DOMParser API did not properly process '' elements for escaping. This could be used as an mXSS vector to bypass an HTML Sanitizer. This vulnerability affects Firefox < 86. Scope: local sid: resolved (fixed in 86.0-1)

CVE-2020-26979 [MEDIUM] CVE-2020-26979: firefox - When a user typed a URL in the address bar or the search bar and quickly hit the... When a user typed a URL in the address bar or the search bar and quickly hit the enter key, a website could sometimes capture that event and then redirect the user before navigation occurred to the desired, entered address. To construct a convincing spoof the attacker would have had to guess what the user was typing, perhaps by suggesting it. This vulnerability af

CVE-2019-11762 [MEDIUM] CVE-2019-11762: firefox - If two same-origin documents set document.domain differently to become cross-ori... If two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call arbitrary DOM methods/getters/setters on the now-cross-origin window. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2. Scope: local sid: resolved (fixed in 70.0-1)

CVE-2017-5408 [MEDIUM] CVE-2017-5408: firefox - Video files loaded video captions cross-origin without checking for the presence... Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting such cross-origin use, leading to potential information disclosure for video captions. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8. Scope: local sid: resolved (fixed in 52.0-1)

CVE-2022-34474 [MEDIUM] CVE-2022-34474: firefox - Even when an iframe was sandboxed with <code>allow-top-navigation-by-user-activa... Even when an iframe was sandboxed with allow-top-navigation-by-user-activation, if it received a redirect header to an external protocol the browser would process the redirect and prompt the user as appropriate. This vulnerability affects Firefox < 102. Scope: local sid: resolved (fixed in 102.0-1)

CVE-2023-34415 [MEDIUM] CVE-2023-34415: firefox - When choosing a site-isolated process for a document loaded from a data: URL tha... When choosing a site-isolated process for a document loaded from a data: URL that was the result of a redirect, Firefox would load that document in the same process as the site that issued the redirect. This bypassed the site-isolation protections against Spectre-like attacks on sites that host an "open redirect". Firefox no longer follows HTTP redirects to data:

CVE-2024-8386 [MEDIUM] CVE-2024-8386: firefox - If a site had been granted the permission to open popup windows, it could cause ... If a site had been granted the permission to open popup windows, it could cause Select elements to appear on top of another site to perform a spoofing attack. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and Thunderbird < 128.2. Scope: local sid: resolved (fixed in 130.0-1)

CVE-2022-36316 [MEDIUM] CVE-2022-36316: firefox - When using the Performance API, an attacker was able to notice subtle difference... When using the Performance API, an attacker was able to notice subtle differences between PerformanceEntries and thus learn whether the target URL had been subject to a redirect. This vulnerability affects Firefox < 103. Scope: local sid: resolved (fixed in 103.0-1)

CVE-2018-5117 [MEDIUM] CVE-2018-5117: firefox - If right-to-left text is used in the addressbar with left-to-right alignment, it... If right-to-left text is used in the addressbar with left-to-right alignment, it is possible in some circumstances to scroll this text to spoof the displayed URL. This issue could result in the wrong URL being displayed as a location, which can mislead users to believe they are on a different site than the one loaded. This vulnerability affects Thunderbird < 52.6, F

CVE-2018-5168 [MEDIUM] CVE-2018-5168: firefox - Sites can bypass security checks on permissions to install lightweight themes by... Sites can bypass security checks on permissions to install lightweight themes by manipulating the "baseURI" property of the theme element. This could allow a malicious site to install a theme without user interaction which could contain offensive or embarrassing images. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox

CVE-2025-6430 [MEDIUM] CVE-2025-6430: firefox - When a file download is specified via the `Content-Disposition` header, that dir... When a file download is specified via the `Content-Disposition` header, that directive would be ignored if the file was included via a ` ` or ` ` tag, potentially making a website vulnerable to a cross-site scripting attack. This vulnerability affects Firefox < 140, Firefox ESR < 128.12, Thunderbird < 140, and Thunderbird < 128.12. Scope: local sid: resolved (fixed