Mozilla Firefox Mobile vulnerabilities

CVE-2020-12400 [MEDIUM] CWE-203 CVE-2020-12400: When converting coordinates from projective to affine, the modular inversion was not performed in co When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

CVE-2020-15668 [MEDIUM] CWE-667 CVE-2020-15668: A lock was missing when accessing a data structure and importing certificate information into the tr A lock was missing when accessing a data structure and importing certificate information into the trust database. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

CVE-2020-12404 [MEDIUM] CWE-79 CVE-2020-12404: For native-to-JS bridging the app requires a unique token to be passed that ensures non-app code can For native-to-JS bridging the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token could leak when used for downloading files. This vulnerability affects Firefox for iOS < 26.

CVE-2024-38313 [MEDIUM] CWE-451 CVE-2024-38313: In certain scenarios a malicious website could attempt to display a fake location URL bar which coul In certain scenarios a malicious website could attempt to display a fake location URL bar which could mislead users as to the actual website address This vulnerability affects Firefox for iOS < 127.

CVE-2012-1143 [MEDIUM] CWE-189 CVE-2012-1143: FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows re FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted font.

CVE-2020-15671 [LOW] CWE-200 CVE-2020-15671: When typing in a password under certain conditions, a race may have occured where the InputContext w When typing in a password under certain conditions, a race may have occured where the InputContext was not being correctly set for the input field, resulting in the typed password being saved to the keyboard dictionary. This vulnerability affects Firefox for Android < 80.