Search CVE reports
611 – 620 of 2389 results
Some fixes available 1 of 14
If an attacker needed a user to load an insecure http: page and knew that user had enabled HTTPS-only mode, the attacker could have tricked the user into clicking to grant an HTTPS-only exception if they could get the user to...
8 affected packages
firefox, thunderbird, mozjs38, mozjs52, mozjs68...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| firefox | — | Not affected | Not affected | Fixed | Ignored |
| thunderbird | — | Not affected | Not affected | Not in release | Ignored |
| mozjs38 | — | Not in release | Not in release | Not in release | Ignored |
| mozjs52 | — | Not in release | Not in release | Ignored | Ignored |
| mozjs68 | — | Not in release | Not in release | Ignored | Not in release |
| mozjs78 | — | Not in release | Ignored | Not in release | Not in release |
| mozjs91 | — | Not in release | Ignored | Not in release | Not in release |
| mozjs102 | — | Ignored | Ignored | Not in release | Not in release |
Some fixes available 1 of 14
When an https: web page created a pop-up from a "javascript:" URL, that pop-up was incorrectly allowed to load blockable content such as iframes from insecure http: URLs This vulnerability affects Firefox < 120.
8 affected packages
firefox, thunderbird, mozjs38, mozjs52, mozjs68...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| firefox | — | Not affected | Not affected | Fixed | Ignored |
| thunderbird | — | Not affected | Not affected | Not in release | Ignored |
| mozjs38 | — | Not in release | Not in release | Not in release | Ignored |
| mozjs52 | — | Not in release | Not in release | Ignored | Ignored |
| mozjs68 | — | Not in release | Not in release | Ignored | Not in release |
| mozjs78 | — | Not in release | Ignored | Not in release | Not in release |
| mozjs91 | — | Not in release | Ignored | Not in release | Not in release |
| mozjs102 | — | Ignored | Ignored | Not in release | Not in release |
Some fixes available 6 of 18
Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in the path could be used to override the specified host. This could contribute to security problems in web sites. This...
8 affected packages
firefox, thunderbird, mozjs38, mozjs52, mozjs68...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| firefox | — | Not affected | Not affected | Fixed | Ignored |
| thunderbird | — | Fixed | Fixed | Fixed | Ignored |
| mozjs38 | — | Not in release | Not in release | Not in release | Ignored |
| mozjs52 | — | Not in release | Not in release | Ignored | Ignored |
| mozjs68 | — | Not in release | Not in release | Ignored | Not in release |
| mozjs78 | — | Not in release | Ignored | Not in release | Not in release |
| mozjs91 | — | Not in release | Ignored | Not in release | Not in release |
| mozjs102 | — | Ignored | Ignored | Not in release | Not in release |
Some fixes available 6 of 18
When using X11, text selected by the page using the Selection API was erroneously copied into the primary selection, a temporary storage not unlike the clipboard. *This bug only affects Firefox on X11. Other systems are...
8 affected packages
mozjs68, firefox, thunderbird, mozjs38, mozjs52...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| mozjs68 | — | Not in release | Not in release | Ignored | Not in release |
| firefox | — | Not affected | Not affected | Fixed | Ignored |
| thunderbird | — | Fixed | Fixed | Fixed | Ignored |
| mozjs38 | — | Not in release | Not in release | Not in release | Ignored |
| mozjs52 | — | Not in release | Not in release | Ignored | Ignored |
| mozjs78 | — | Not in release | Ignored | Not in release | Not in release |
| mozjs91 | — | Not in release | Ignored | Not in release | Not in release |
| mozjs102 | — | Ignored | Ignored | Not in release | Not in release |
Some fixes available 6 of 18
Ownership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5.
8 affected packages
firefox, thunderbird, mozjs38, mozjs52, mozjs68...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| firefox | — | Not affected | Not affected | Fixed | Ignored |
| thunderbird | — | Fixed | Fixed | Fixed | Ignored |
| mozjs38 | — | Not in release | Not in release | Not in release | Ignored |
| mozjs52 | — | Not in release | Not in release | Ignored | Ignored |
| mozjs68 | — | Not in release | Not in release | Ignored | Not in release |
| mozjs78 | — | Not in release | Ignored | Not in release | Not in release |
| mozjs91 | — | Not in release | Ignored | Not in release | Not in release |
| mozjs102 | — | Ignored | Ignored | Not in release | Not in release |
Some fixes available 6 of 18
The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts. It was possible to use this fact to surprise users by luring them to click where the permission grant...
8 affected packages
mozjs68, firefox, thunderbird, mozjs38, mozjs52...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| mozjs68 | — | Not in release | Not in release | Ignored | Not in release |
| firefox | — | Not affected | Not affected | Fixed | Ignored |
| thunderbird | — | Fixed | Fixed | Fixed | Ignored |
| mozjs38 | — | Not in release | Not in release | Not in release | Ignored |
| mozjs52 | — | Not in release | Not in release | Ignored | Ignored |
| mozjs78 | — | Not in release | Ignored | Not in release | Not in release |
| mozjs91 | — | Not in release | Ignored | Not in release | Not in release |
| mozjs102 | — | Ignored | Ignored | Not in release | Not in release |
Some fixes available 6 of 18
It was possible to cause the use of a MessagePort after it had already been freed, which could potentially have led to an exploitable crash. This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Thunderbird < 115.5.
8 affected packages
mozjs68, firefox, thunderbird, mozjs38, mozjs52...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| mozjs68 | — | Not in release | Not in release | Ignored | Not in release |
| firefox | — | Not affected | Not affected | Fixed | Ignored |
| thunderbird | — | Fixed | Fixed | Fixed | Ignored |
| mozjs38 | — | Not in release | Not in release | Not in release | Ignored |
| mozjs52 | — | Not in release | Not in release | Ignored | Ignored |
| mozjs78 | — | Not in release | Ignored | Not in release | Not in release |
| mozjs91 | — | Not in release | Ignored | Not in release | Not in release |
| mozjs102 | — | Ignored | Ignored | Not in release | Not in release |
Some fixes available 6 of 18
On some systems—depending on the graphics settings and drivers—it was possible to force an out-of-bounds read and leak memory data into the images created on the canvas element. This vulnerability affects Firefox < 120, Firefox...
8 affected packages
firefox, thunderbird, mozjs38, mozjs52, mozjs68...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| firefox | — | Not affected | Not affected | Fixed | Ignored |
| thunderbird | — | Fixed | Fixed | Fixed | Ignored |
| mozjs38 | — | Not in release | Not in release | Not in release | Ignored |
| mozjs52 | — | Not in release | Not in release | Ignored | Ignored |
| mozjs68 | — | Not in release | Not in release | Ignored | Not in release |
| mozjs78 | — | Not in release | Ignored | Not in release | Not in release |
| mozjs91 | — | Not in release | Ignored | Not in release | Not in release |
| mozjs102 | — | Ignored | Ignored | Not in release | Not in release |
An attacker could have performed HTML template injection via Reader Mode and exfiltrated user information. This vulnerability affects Firefox for iOS < 120.
2 affected packages
firefox, thunderbird
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| firefox | — | — | Not affected | Not in release | Ignored |
| thunderbird | — | — | Not affected | Not in release | Ignored |
An attacker could have accessed internal pages or data by ex-filtrating a security key from ReaderMode via the `referrerpolicy` attribute. This vulnerability affects Firefox for iOS < 120.
2 affected packages
firefox, thunderbird
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| firefox | — | — | Not affected | Not in release | Ignored |
| thunderbird | — | — | Not affected | Not in release | Ignored |