Firefox vulnerabilities

Members of the DEVMODEW struct set by the printer device driver weren't being validated and could have resulted in invalid values which in turn would cause the browser to attempt out of bounds access to related variables. This bug only affects Firefox on Windows.

An invalid downcast from nsTextNode to SVGElement could lead to undefined behavior in Firefox and Thunderbird. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.

A vulnerability in Firefox and Thunderbird involving cross-compartment wrappers wrapping a scripted proxy. This could cause objects from other compartments to be stored in the main compartment, resulting in a use-after-free after unwrapping the proxy.

After downloading a Windows .url shortcut from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requests from the operating system. This also had the potential to leak NTLM credentials to the resource. This bug only affects Firefox on Windows. Other operating systems are unaffected. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.

When encoding data from an inputStream in xpcom the size of the input being encoded was not correctly calculated potentially leading to an out of bounds memory write. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.

A background script invoking requestFullscreen and then blocking the main thread could force the browser into fullscreen mode indefinitely, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.

The Content-Security-Policy-Report-Only header could allow an attacker to leak a child iframe's unredacted URI when interaction with that iframe triggers a redirect. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.

Memory safety bugs reported by Mozilla developers and the Mozilla Fuzzing Team in Firefox 108 and Firefox ESR 102.6. Some showed evidence of memory corruption and could potentially be exploited to run arbitrary code.

Firefox allowed navigation when dragging a URL from a cross-origin iframe into the same tab, which could lead to website spoofing attacks. The vulnerability affects Firefox < 109, Firefox ESR < 102.7, and Thunderbird < 102.7.

When copying a network request from the developer tools panel as a curl command the output was not being properly sanitized and could allow arbitrary commands to be hidden within. This vulnerability affects Firefox < 109, Firefox ESR < 102.7, and Thunderbird < 102.7.

Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged, a website could arbitrarily read a file via a call to DataTransfer.setData. This vulnerability affects Firefox < 109, Firefox ESR < 102.7, and Thunderbird < 102.7.

An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.

Scanning a QR code that contained a javascript: URL would have resulted in the Javascript being executed.

Vulnerability in Firefox related to the EC scalar point multiplication algorithm (wNAF) that leaks partial information about the nonce used during signature generation. Based on electromagnetic traces, the private key could be computed.

During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent on secret data. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

A lock was missing when accessing a data structure and importing certificate information into the trust database. Affects Firefox < 80 and Firefox for Android < 80.

Vulnerability in Firefox (and Firefox for Android) before version 80. When trying to load a non-video in an audio/video context, the exact status code (e.g., 200, 302, 404, 500) is disclosed via the MediaError message. This information leakage may allow inferring login status to services or device discovery on a local network.