Firefox vulnerabilities

When handling the filename directive in the Content-Disposition header, the filename would be truncated if it contained a NULL character. This could lead to reflected file download attacks potentially tricking users to install malware.

Under specific circumstances a WebExtension may have received a jar:file:/// URI instead of a moz-extension:/// URI during a load request. This leaked directory paths on the user's machine. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.

Multiple race conditions in font initialization could have led to memory corruption and execution of attacker-controlled code. This affects Firefox for Android, Firefox, and Focus for Android versions prior to 112.

Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced, resulting in memory corruption and a potentially exploitable crash. Affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.

A website could obscure the fullscreen notification by using a combination of window.open, fullscreen requests, window.name assignments, and setInterval calls. This could lead to user confusion and possible spoofing attacks. Affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.

Scanning a QR code that contained a javascript: URL would have resulted in the Javascript being executed.

Vulnerability in Firefox related to the EC scalar point multiplication algorithm (wNAF) that leaks partial information about the nonce used during signature generation. Based on electromagnetic traces, the private key could be computed.

During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent on secret data. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

A lock was missing when accessing a data structure and importing certificate information into the trust database. Affects Firefox < 80 and Firefox for Android < 80.

Vulnerability in Firefox (and Firefox for Android) before version 80. When trying to load a non-video in an audio/video context, the exact status code (e.g., 200, 302, 404, 500) is disclosed via the MediaError message. This information leakage may allow inferring login status to services or device discovery on a local network.