Firefox, Thunderbird vulnerabilities

Denial-of-service in the Printing: Output component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Race condition in the Networking: DNS component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

Integer overflow in the Audio/Video: Playback component in Firefox and Thunderbird. Fixed in versions 153.

Integer overflow in the Audio/Video component in Firefox and Thunderbird. Fixed in versions 153.

Memory safety bugs were found in Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption, which could potentially allow arbitrary code execution. The vulnerabilities were fixed in Firefox 149 and Thunderbird 149.

Memory safety bugs were found in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and could potentially be exploited to run arbitrary code with enough effort.

Memory safety bugs were found in Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and could potentially be exploited to run arbitrary code. The vulnerability was fixed in Firefox 148 and Thunderbird 148.

Memory safety bugs were found in Firefox ESR 140.7, Firefox 147, Thunderbird ESR 140.7, and Thunderbird 147. Some of these bugs showed evidence of memory corruption and could potentially be exploited to run arbitrary code with enough effort.

Clickjacking vulnerability in the Widget component in Firefox and Thunderbird. The issue was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

Integer overflow in the Graphics component in Firefox and Thunderbird. The issue was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

Privilege escalation in the Shell Integration component in Firefox and Thunderbird. The issue was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

Information disclosure in the WebRTC component in Firefox and Thunderbird. The issue was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

Privilege escalation in the Request Handling component in Firefox and Thunderbird. The issue was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

Memory safety bugs were found in Firefox 151 and Thunderbird 151. Some of these bugs showed evidence of memory corruption, potentially allowing arbitrary code execution. The vulnerabilities were fixed in Firefox 152 and Thunderbird 152.

Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Thunderbird 152 as well.

A memory safety bug was fixed in Firefox 152 and Thunderbird 152. This vulnerability also affects Firefox ESR 140.12 and Thunderbird 140.12.

A memory safety bug was fixed in Firefox 152 and Thunderbird 152. This vulnerability was also patched in the ESR versions of both Firefox and Thunderbird.

A memory safety bug was fixed in Firefox 152 and Thunderbird 152. This vulnerability was also patched in the ESR versions of Firefox and Thunderbird.

Memory safety bug fixed in Firefox 152. This vulnerability was also fixed in Thunderbird 152.

Memory safety bug fixed in Firefox 152. This vulnerability was also fixed in Thunderbird 152.

A same-origin policy bypass exists in the Networking: JAR component of Firefox and Thunderbird. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

Spoofing issue in the Popup Blocker component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

Memory safety bugs present in Firefox 137 and Thunderbird 137. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 138 and Thunderbird 138.

JavaScript code running while transforming a document with the XSLTProcessor could lead to a use-after-free. This vulnerability was fixed in Firefox 137, Firefox ESR 115.22, Firefox ESR 128.9, Thunderbird 137, and Thunderbird 128.9.

When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.

Assuming a controlled failed memory allocation, an attacker could have caused a use-after-free, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Firefox ESR 115.19, Thunderbird 134, and Thunderbird 128.6.

A vulnerability in Firefox and Thunderbird allows an attacker to determine if an application implementing a specific protocol handler is installed by checking the results of window.open calls with specially set protocol handlers. This affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131.

A vulnerability in Firefox allows appref-ms files to be opened without warning the user that they may contain malicious code. This affects Firefox versions below 116 and Thunderbird versions below 102.14 and 115.1 on Windows.

The vulnerability in Firefox and Thunderbird involves the lack of a warning for users when opening Diagcab files that may contain malicious code. This affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13.

Vulnerability in Firefox browser and Thunderbird mail client. A malicious webpage could access the InstallTrigger object, potentially leading to installation of an unintended or malicious extension.