Firefox vulnerabilities

A sandbox escape vulnerability exists in the Graphics: CanvasWebGL component due to incorrect boundary conditions. This flaw was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

This vulnerability allows bypassing security mechanisms in the DOM component of Firefox and Thunderbird. The flaw is fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

In Firefox, a select option could partially obscure security prompts. A malicious site could use this to trick a user into granting permissions. This issue only affects Android versions of Firefox and affects Firefox < 129.

In Firefox, when configured to block the storage of all cookies, it was still possible to store data in localstorage using an iframe with a source of 'about:blank'. This could lead to malicious websites storing tracking data without user consent.

Memory safety bugs present in Firefox 114. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

A website could prevent a user from exiting full-screen mode via alert and prompt calls. This could lead to user confusion and possible spoofing attacks. This vulnerability affects Firefox versions below 115.

A use-after-free condition existed in `NotifyOnHistoryReload` where a `LoadingSessionHistoryEntry` object was freed and a reference to that object remained. This resulted in a potentially exploitable condition when the reference to that object was later reused.

The vulnerability allows an attacker to trick a user into submitting sensitive data to a malicious website by uploading files that contain symlinks. This affects Firefox versions below 115.

The use of RTL Arabic characters in the address bar may have allowed for URL spoofing. This vulnerability affects Firefox versions below 115.

A vulnerability in Firefox (< 115) allows a website to obscure the fullscreen notification by using an option element, potentially causing delays due to an expensive computational function. This could lead to user confusion and possible spoofing attacks.

Insufficient validation in the Drag and Drop API, in conjunction with social engineering, may have allowed an attacker to trick end-users into creating a shortcut to local system files. This could have been leveraged to execute arbitrary code.

A vulnerability in Firefox allowed a document loaded from a data: URL resulting from a redirect to be loaded in the same process as the site that issued the redirect, bypassing site-isolation protections against Spectre-like attacks.

Memory safety bugs present in Firefox 111. Some of these bugs showed evidence of memory corruption, potentially allowing arbitrary code execution. This affects Firefox for Android, Firefox, and Focus for Android versions prior to 112.

Under certain circumstances, a call to the bind function may have resulted in the incorrect realm. This may have created a vulnerability relating to JavaScript-implemented sandboxes such as SES. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.

A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.

If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused memory corruption and a potentially exploitable crash. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.

An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object's debugger vector. This affects Firefox for Android, Firefox, and Focus for Android versions prior to 112.

Firefox improperly handled downloads of files ending in .desktop, which can be interpreted to run attacker-controlled commands. This bug only affects Firefox for Linux on certain distributions.

Using a redirect embedded into sourceMappingUrls could allow for navigation to external protocol links in sandboxed iframes without allow-top-navigation-to-custom-protocols. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.

When handling the filename directive in the Content-Disposition header, the filename would be truncated if it contained a NULL character. This could lead to reflected file download attacks potentially tricking users to install malware.

Under specific circumstances a WebExtension may have received a jar:file:/// URI instead of a moz-extension:/// URI during a load request. This leaked directory paths on the user's machine. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.

Multiple race conditions in font initialization could have led to memory corruption and execution of attacker-controlled code. This affects Firefox for Android, Firefox, and Focus for Android versions prior to 112.

Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced, resulting in memory corruption and a potentially exploitable crash. Affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.

A website could obscure the fullscreen notification by using a combination of window.open, fullscreen requests, window.name assignments, and setInterval calls. This could lead to user confusion and possible spoofing attacks. Affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.

Scanning a QR code that contained a javascript: URL would have resulted in the Javascript being executed.

Vulnerability in Firefox related to the EC scalar point multiplication algorithm (wNAF) that leaks partial information about the nonce used during signature generation. Based on electromagnetic traces, the private key could be computed.

During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent on secret data. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

A lock was missing when accessing a data structure and importing certificate information into the trust database. Affects Firefox < 80 and Firefox for Android < 80.

Vulnerability in Firefox (and Firefox for Android) before version 80. When trying to load a non-video in an audio/video context, the exact status code (e.g., 200, 302, 404, 500) is disclosed via the MediaError message. This information leakage may allow inferring login status to services or device discovery on a local network.