Mozilla FireFox Extended Support Release (ESR)

Uninitialized memory in a

CVE-2021-29980 8.8 - High - August 17, 2021

Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91.

Missing Initialization of Resource

Firefox incorrectly treated an inline list-item element as a block element

CVE-2021-29988 8.8 - High - August 17, 2021

Firefox incorrectly treated an inline list-item element as a block element, resulting in an out of bounds read or memory corruption, and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91.

Interpretation Conflict

A use-after-free vulnerability in media channels could have led to memory corruption and a potentially exploitable crash

CVE-2021-29985 8.8 - High - August 17, 2021

A use-after-free vulnerability in media channels could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91.

Dangling pointer

Instruction reordering resulted in a sequence of instructions

CVE-2021-29984 8.8 - High - August 17, 2021

Instruction reordering resulted in a sequence of instructions that would cause an object to be incorrectly considered during garbage collection. This led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91.

Mozilla developers reported memory safety bugs present in Firefox 90 and Firefox ESR 78.12

CVE-2021-29989 8.8 - High - August 17, 2021

Mozilla developers reported memory safety bugs present in Firefox 90 and Firefox ESR 78.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.13, Firefox ESR < 78.13, and Firefox < 91.

Buffer Overflow

Mozilla developers reported memory safety bugs present in code shared between Firefox and Thunderbird

CVE-2021-29976 8.8 - High - August 05, 2021

Mozilla developers reported memory safety bugs present in code shared between Firefox and Thunderbird. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.12, Firefox ESR < 78.12, and Firefox < 90.

Memory Corruption

A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially exploitable crash

CVE-2021-29970 8.8 - High - August 05, 2021

A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially exploitable crash. *This bug could only be triggered when accessibility was enabled.*. This vulnerability affects Thunderbird < 78.12, Firefox ESR < 78.12, and Firefox < 90.

Dangling pointer

Mozilla developers reported memory safety bugs present in Firefox 88 and Firefox ESR 78.11

CVE-2021-29967 8.8 - High - June 24, 2021

Mozilla developers reported memory safety bugs present in Firefox 88 and Firefox ESR 78.11. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.11, Firefox < 89, and Firefox ESR < 78.11.

Buffer Overflow

Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed port blocking restrictions when used in the Alt-Svc header

CVE-2021-29946 8.8 - High - June 24, 2021

Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed port blocking restrictions when used in the Alt-Svc header. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.

Integer Overflow or Wraparound

A transient execution vulnerability, named Floating Point Value Injection (FPVI)

CVE-2021-29955 5.3 - Medium - June 24, 2021

A transient execution vulnerability, named Floating Point Value Injection (FPVI) allowed an attacker to leak arbitrary memory addresses and may have also enabled JIT type confusion attacks. (A related vulnerability, Speculative Code Store Bypass (SCSB), did not affect Firefox.). This vulnerability affects Firefox ESR < 78.9 and Firefox < 87.

Injection

The WebAssembly JIT could miscalculate the size of a return type, which could lead to a null read and result in a crash

CVE-2021-29945 6.5 - Medium - June 24, 2021

The WebAssembly JIT could miscalculate the size of a return type, which could lead to a null read and result in a crash. *Note: This issue only affected x86-32 platforms. Other platforms are unaffected.*. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.

Incorrect Calculation

When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the newlines would have been interpreted as such and

CVE-2021-24002 8.8 - High - June 24, 2021

When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the newlines would have been interpreted as such and allowed arbitrary commands to be sent to the FTP server. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.

Argument Injection

If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional privileges

CVE-2021-23999 8.8 - High - June 24, 2021

If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional privileges that should not be granted to web content. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.

Improper Privilege Management

Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS page

CVE-2021-23998 6.5 - Medium - June 24, 2021

Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS page. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.

Insufficient Verification of Data Authenticity

When Responsive Design Mode was enabled, it used references to objects that were previously freed

CVE-2021-23995 8.8 - High - June 24, 2021

When Responsive Design Mode was enabled, it used references to objects that were previously freed. We presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.

Operation on a Resource after Expiration or Release

A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write

CVE-2021-23994 8.8 - High - June 24, 2021

A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.

Missing Initialization of Resource

A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer used to unpack it

CVE-2021-23981 8.1 - High - March 31, 2021

A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer used to unpack it, resulting in memory corruption and a potentially exploitable information leak or crash. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9.

Buffer Overflow

Using techniques that built on the slipstream research, a malicious webpage could have s

CVE-2021-23982 6.5 - Medium - March 31, 2021

Using techniques that built on the slipstream research, a malicious webpage could have scanned both an internal network's hosts as well as services running on the user's local machine utilizing WebRTC connections. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9.

Inadequate Encryption Strength

A malicious extension could have opened a popup window lacking an address bar

CVE-2021-23984 6.5 - Medium - March 31, 2021

A malicious extension could have opened a popup window lacking an address bar. The title of the popup lacking an address bar should not be fully controllable, but in this situation was. This could have been used to spoof a website and attempt to trick the user into providing credentials. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9.

Authentication Bypass by Spoofing

Mozilla developers and community members reported memory safety bugs present in Firefox 86 and Firefox ESR 78.8

CVE-2021-23987 8.8 - High - March 31, 2021

Mozilla developers and community members reported memory safety bugs present in Firefox 86 and Firefox ESR 78.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9.

Buffer Overflow

Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6

CVE-2021-23964 8.8 - High - February 26, 2021

Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7.

Buffer Overflow

Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7

CVE-2021-23978 8.8 - High - February 26, 2021

Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8.

If a user clicked into a specifically crafted PDF

CVE-2021-23953 4.3 - Medium - February 26, 2021

If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-origin information, when said information is served as chunked data. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7.

Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion

CVE-2021-23954 8.8 - High - February 26, 2021

Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading to a memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7.

Object Type Confusion

Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially exploitable crash

CVE-2021-23960 8.8 - High - February 26, 2021

Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially exploitable crash. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7.

If Content Security Policy blocked frame navigation

CVE-2021-23968 4.3 - Medium - February 26, 2021

If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation report; as opposed to the original frame URI. This could be used to leak sensitive information contained in such URIs. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8.

Generation of Error Message Containing Sensitive Information

As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure

CVE-2021-23969 4.3 - Medium - February 26, 2021

As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested by the page, pre-redirects. If thats not possible, user agents need to strip the URL down to an origin to avoid unintentional leakage." Under certain types of redirects, Firefox incorrectly set the source file to be the destination of the redirects. This was fixed to be the redirect destination's origin. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8.

When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted, and the content of

CVE-2021-23973 6.5 - Medium - February 26, 2021

When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted, and the content of that error may have revealed information about the resource. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8.

Generation of Error Message Containing Sensitive Information

Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow on some video drivers

CVE-2020-26971 8.8 - High - January 07, 2021

Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow on some video drivers. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6.

Memory Corruption

Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed

CVE-2020-26973 8.8 - High - January 07, 2021

Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This could have been used as a sanitizer bypass. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6.

When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly cast to the wrong type

CVE-2020-26974 8.8 - High - January 07, 2021

When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly cast to the wrong type. This resulted in a heap user-after-free, memory corruption, and a potentially exploitable crash. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6.

Memory Corruption

Using techniques that built on the slipstream research

CVE-2020-26978 6.1 - Medium - January 07, 2021

Using techniques that built on the slipstream research, a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6.

When an extension with the proxy permission registered to receive <all_urls>

CVE-2020-35111 4.3 - Medium - January 07, 2021

When an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest callback was not triggered for view-source URLs. While web content cannot navigate to such URLs, a user opening View Source could have inadvertently leaked their IP address. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6.

Mozilla developers reported memory safety bugs present in Firefox 83 and Firefox ESR 78.5

CVE-2020-35113 8.8 - High - January 07, 2021

Mozilla developers reported memory safety bugs present in Firefox 83 and Firefox ESR 78.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6.

Memory Corruption

In certain circumstances, the MCallGetProperty opcode

CVE-2020-26950 8.8 - High - December 09, 2020

In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condition. This vulnerability affects Firefox < 82.0.3, Firefox ESR < 78.4.1, and Thunderbird < 78.4.2.

Dangling pointer

A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization

CVE-2020-26951 6.1 - Medium - December 09, 2020

A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization. An attacker already capable of exploiting an XSS vulnerability in privileged internal pages could have used this attack to bypass our built-in sanitizer. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.

XSS

It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus making it possible to attempt a phishing attack or otherwise confuse the user

CVE-2020-26953 4.3 - Medium - December 09, 2020

It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus making it possible to attempt a phishing attack or otherwise confuse the user. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.

Clickjacking

In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS

CVE-2020-26956 6.1 - Medium - December 09, 2020

In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.

XSS

Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker

CVE-2020-26958 6.1 - Medium - December 09, 2020

Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a Content Security Policy bypass. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.

XSS

During browser shutdown

CVE-2020-26959 8.8 - High - December 09, 2020

During browser shutdown, reference decrementing could have occured on a previously freed object, resulting in a use-after-free, memory corruption, and a potentially exploitable crash. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.

Dangling pointer

If the Compact() method was called on an nsTArray

CVE-2020-26960 8.8 - High - December 09, 2020

If the Compact() method was called on an nsTArray, the array could have been reallocated without updating other pointers, leading to a potential use-after-free and exploitable crash. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.

Dangling pointer

When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges

CVE-2020-26961 6.5 - Medium - December 09, 2020

When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses as these do not make sense coming from a DoH resolver. However when an IPv4 address was mapped through IPv6, these addresses were erroneously let through, leading to a potential DNS Rebinding attack. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.

Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field

CVE-2020-26965 6.5 - Medium - December 09, 2020

Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field, revealing the typed password. If, when using a software keyboard that remembers user input, a user typed their password and used that feature, the type of the password field was changed, resulting in a keyboard layout change and the possibility for the software keyboard to remember the typed password. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.

Improper Removal of Sensitive Information Before Storage or Transfer

Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4

CVE-2020-26968 8.8 - High - December 09, 2020

Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.

Memory Corruption

Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3

CVE-2020-15683 9.8 - Critical - October 22, 2020

Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.4, Firefox < 82, and Thunderbird < 78.4.

If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe

CVE-2020-15663 8.8 - High - October 01, 2020

If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the install location with system privileges. Although the Mozilla Maintenance Service does ensure that updater.exe is signed by Mozilla, the version could have been rolled back to a previous version which would have allowed exploitation of an older bug and arbitrary code execution with System Privileges. *Note: This issue only affected Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Firefox < 80, Thunderbird < 78.2, Thunderbird < 68.12, Firefox ESR < 68.12, and Firefox ESR < 78.2.

Improper Privilege Management

By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would

CVE-2020-15664 6.5 - Medium - October 01, 2020

By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would allow them to prompt the user to install an extension. Combined with user confusion, this could result in an unintended or malicious extension being installed. This vulnerability affects Firefox < 80, Thunderbird < 78.2, Thunderbird < 68.12, Firefox ESR < 68.12, Firefox ESR < 78.2, and Firefox for Android < 80.

AuthZ

When aborting an operation, such as a fetch, an abort signal may be deleted while alerting the objects to be notified

CVE-2020-15669 8.8 - High - October 01, 2020

When aborting an operation, such as a fetch, an abort signal may be deleted while alerting the objects to be notified. This results in a use-after-free and we presume that with enough effort it could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.12 and Thunderbird < 68.12.

Dangling pointer

Mozilla developers reported memory safety bugs present in Firefox for Android 79

CVE-2020-15670 8.8 - High - October 01, 2020

Mozilla developers reported memory safety bugs present in Firefox for Android 79. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 80, Firefox ESR < 78.2, Thunderbird < 78.2, and Firefox for Android < 80.

Release of Invalid Pointer or Reference

Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2

CVE-2020-15673 8.8 - High - October 01, 2020

Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3.

Release of Invalid Pointer or Reference

Firefox sometimes ran the onload handler for SVG elements

CVE-2020-15676 6.1 - Medium - October 01, 2020

Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attacker-controlled data into a contenteditable element. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3.

XSS

By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original site (the one suffering

CVE-2020-15677 6.1 - Medium - October 01, 2020

By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original site (the one suffering from the open redirect) rather than the site the file was actually downloaded from. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3.

Open Redirect

When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free

CVE-2020-15678 8.8 - High - October 01, 2020

When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free. This occurs because the function APZCTreeManager::ComputeClippedCompositionBounds did not follow iterator invalidation rules. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3.

Dangling pointer

By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect

CVE-2020-15652 6.5 - Medium - August 10, 2020

By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect. This applied only to content that can be parsed as script. This vulnerability affects Firefox < 79, Firefox ESR < 68.11, Firefox ESR < 78.1, Thunderbird < 68.11, and Thunderbird < 78.1.

Origin Validation Error

An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links

CVE-2020-15653 6.5 - Medium - August 10, 2020

An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links. This could have led to security issues for websites relying on sandbox configurations that allowed popups and hosted arbitrary content. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.

When in an endless loop

CVE-2020-15654 6.5 - Medium - August 10, 2020

When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interface, when they are not. This could lead to a perceived broken state, especially when interactions with existing browser dialogs and warnings do not work. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.

Infinite Loop

A redirected HTTP request

CVE-2020-15655 6.5 - Medium - August 10, 2020

A redirected HTTP request which is observed or modified through a web extension could bypass existing CORS checks, leading to potential disclosure of cross-origin information. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.

Information Disclosure

JIT optimizations involving the Javascript arguments object could confuse later optimizations

CVE-2020-15656 8.8 - High - August 10, 2020

JIT optimizations involving the Javascript arguments object could confuse later optimizations. This risk was already mitigated by various precautions in the code, resulting in this bug rated at only moderate severity. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.

Object Type Confusion

The code for downloading files did not properly take care of special characters

CVE-2020-15658 6.5 - Medium - August 10, 2020

The code for downloading files did not properly take care of special characters, which led to an attacker being able to cut off the file ending at an earlier position, leading to a different file type being downloaded than shown in the dialog. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.

Improper Check for Unusual or Exceptional Conditions

Mozilla developers and community members reported memory safety bugs present in Firefox 78 and Firefox ESR 78.0

CVE-2020-15659 8.8 - High - August 10, 2020

Mozilla developers and community members reported memory safety bugs present in Firefox 78 and Firefox ESR 78.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 79, Firefox ESR < 68.11, Firefox ESR < 78.1, Thunderbird < 68.11, and Thunderbird < 78.1.

Memory Corruption

NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys

CVE-2020-12399 4.4 - Medium - July 09, 2020

NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9.

Side Channel Attack

When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash

CVE-2020-12405 5.3 - Medium - July 09, 2020

When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9.

Dangling pointer

Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting in a crash

CVE-2020-12406 8.8 - High - July 09, 2020

Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9.

Insufficient Verification of Data Authenticity

Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8

CVE-2020-12410 8.8 - High - July 09, 2020

Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9.

Buffer Overflow

Due to confusion about ValueTags on JavaScript Objects

CVE-2020-12417 8.8 - High - July 09, 2020

Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memory corruption and a potentially exploitable crash. *Note: this issue only affects Firefox on ARM64 platforms.* This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0.

Buffer Overflow

Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript

CVE-2020-12418 6.5 - Medium - July 09, 2020

Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0.

Out-of-bounds Read

When processing callbacks

CVE-2020-12419 8.8 - High - July 09, 2020

When processing callbacks that occurred during window flushing in the parent process, the associated window may die; causing a use-after-free condition. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0.

Dangling pointer

When trying to connect to a STUN server

CVE-2020-12420 8.8 - High - July 09, 2020

When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0.

Dangling pointer

When performing add-on updates

CVE-2020-12421 6.5 - Medium - July 09, 2020

When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by an administrator.) This could have caused add-ons to become out-of-date silently without notification to the user. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0.

Improper Certificate Validation

An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM

CVE-2018-12371 8.8 - High - July 09, 2020

An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM. This results in the use of uninitialized memory, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 60.1, Thunderbird < 60, and Firefox < 61.

Integer Overflow or Wraparound

A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC

CVE-2020-6831 9.8 - Critical - May 26, 2020

A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0.

Classic Buffer Overflow

A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability

CVE-2020-12387 8.1 - High - May 26, 2020

A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This resulted in a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0.

Race Condition

The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request

CVE-2020-12392 5.5 - Medium - May 26, 2020

The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in the disclosure of local files. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0.

Information Disclosure

Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR 68.7

CVE-2020-12395 9.8 - Critical - May 26, 2020

Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR 68.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0.

Buffer Overflow

Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free

CVE-2020-6819 8.1 - High - April 24, 2020

Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.

Dangling pointer

Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free

CVE-2020-6820 8.1 - High - April 24, 2020

Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.

Double-free

When reading from areas partially or fully outside the source resource with WebGL's <code>copyTexSubImage</code> method

CVE-2020-6821 7.5 - High - April 24, 2020

When reading from areas partially or fully outside the source resource with WebGL's <code>copyTexSubImage</code> method, the specification requires the returned values be zero. Previously, this memory was uninitialized, leading to potentially sensitive data disclosure. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75.

Buffer Overflow

On 32-bit builds, an out of bounds write could have occurred when processing an image larger than 4 GB in <code>GMPDecodeData</code>

CVE-2020-6822 8.8 - High - April 24, 2020

On 32-bit builds, an out of bounds write could have occurred when processing an image larger than 4 GB in <code>GMPDecodeData</code>. It is possible that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75.

Memory Corruption

Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 74 and Firefox ESR 68.6

CVE-2020-6825 9.8 - Critical - April 24, 2020

Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 74 and Firefox ESR 68.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75.

Buffer Overflow

When removing data about an origin whose tab was recently closed

CVE-2020-6805 8.8 - High - March 25, 2020

When removing data about an origin whose tab was recently closed, a use-after-free could occur in the Quota manager, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6.

Dangling pointer

By carefully crafting promise resolutions

CVE-2020-6806 8.8 - High - March 25, 2020

By carefully crafting promise resolutions, it was possible to cause an out-of-bounds read off the end of an array resized during script execution. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6.

Out-of-bounds Read

When a device was changed while a stream was about to be destroyed

CVE-2020-6807 8.8 - High - March 25, 2020

When a device was changed while a stream was about to be destroyed, the <code>stream-reinit</code> task may have been executed after the stream was destroyed, causing a use-after-free and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6.

Dangling pointer

The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request

CVE-2020-6811 8.8 - High - March 25, 2020

The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the 'Copy as Curl' feature and pasted the command into a terminal, it could have resulted in command injection and arbitrary command execution. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6.

Injection

The first time AirPods are connected to an iPhone, they become named after the user's name by default (e.g

CVE-2020-6812 5.3 - Medium - March 25, 2020

The first time AirPods are connected to an iPhone, they become named after the user's name by default (e.g. Jane Doe's AirPods.) Websites with camera or microphone permission are able to enumerate device names, disclosing the user's name. To resolve this issue, Firefox added a special case that renames devices containing the substring 'AirPods' to simply 'AirPods'. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6.

Information Disclosure

Mozilla developers reported memory safety bugs present in Firefox and Thunderbird 68.5

CVE-2020-6814 9.8 - Critical - March 25, 2020

Mozilla developers reported memory safety bugs present in Firefox and Thunderbird 68.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6.

Buffer Overflow

A content process could have modified shared memory relating to crash reporting information, crash itself, and cause an out-of-bound write

CVE-2020-6796 8.8 - High - March 02, 2020

A content process could have modified shared memory relating to crash reporting information, crash itself, and cause an out-of-bound write. This could have caused memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 73 and Firefox < ESR68.5.

Memory Corruption

If a template tag was used in a select tag, the parser could be confused and

CVE-2020-6798 6.1 - Medium - March 02, 2020

If a template tag was used in a select tag, the parser could be confused and allow JavaScript parsing and execution when it should not be allowed. A site that relied on the browser behaving correctly could suffer a cross-site scripting vulnerability as a result. In general, this flaw cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but is potentially a risk in browser or browser-like contexts. This vulnerability affects Thunderbird < 68.5, Firefox < 73, and Firefox < ESR68.5.

XSS

Mozilla developers and community members reported memory safety bugs present in Firefox 72 and Firefox ESR 68.4

CVE-2020-6800 8.8 - High - March 02, 2020

Mozilla developers and community members reported memory safety bugs present in Firefox 72 and Firefox ESR 68.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. In general, these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts. This vulnerability affects Thunderbird < 68.5, Firefox < 73, and Firefox < ESR68.5.

Buffer Overflow

Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion

CVE-2019-17026 8.8 - High - March 02, 2020

Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox < 72.0.1.

Object Type Confusion

Given a compromised sandboxed content process due to a separate vulnerability, it is possible to escape

CVE-2019-9812 9.3 - Critical - January 08, 2020

Given a compromised sandboxed content process due to a separate vulnerability, it is possible to escape that sandbox by loading accounts.firefox.com in that process and forcing a log-in to a malicious Firefox Sync account. Preference settings that disable the sandbox are then synchronized to the local machine and the compromised browser would restart without the sandbox if a crash is triggered. This vulnerability affects Firefox ESR < 60.9, Firefox ESR < 68.1, and Firefox < 69.

Improper Input Validation

The plain text serializer used a fixed-size array for the number of <ol> elements it could process; however it was possible to overflow the static-sized array leading to memory corruption and a potentially exploitable crash

CVE-2019-17005 8.8 - High - January 08, 2020

The plain text serializer used a fixed-size array for the number of <ol> elements it could process; however it was possible to overflow the static-sized array leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

Classic Buffer Overflow

When using nested workers, a use-after-free could occur during worker destruction

CVE-2019-17008 8.8 - High - January 08, 2020

When using nested workers, a use-after-free could occur during worker destruction. This resulted in a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

Dangling pointer

Under certain conditions

CVE-2019-17010 7.5 - High - January 08, 2020

Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have caused a use-after-free and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

Dangling pointer

Under certain conditions, when retrieving a document

CVE-2019-17011 7.5 - High - January 08, 2020

Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could cause a use-after-free condition and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

Dangling pointer

Mozilla developers reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2

CVE-2019-17012 8.8 - High - January 08, 2020

Mozilla developers reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

Classic Buffer Overflow

When pasting a &lt;style&gt; tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule

CVE-2019-17016 6.1 - Medium - January 08, 2020

When pasting a &lt;style&gt; tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.

XSS

Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash

CVE-2019-17017 8.8 - High - January 08, 2020

Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.

Object Type Confusion

When pasting a &lt;style&gt; tag from the clipboard into a rich text editor, the CSS sanitizer does not escape &lt; and &gt; characters

CVE-2019-17022 6.1 - Medium - January 08, 2020

When pasting a &lt;style&gt; tag from the clipboard into a rich text editor, the CSS sanitizer does not escape &lt; and &gt; characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently copies the node's innerHTML, assigning it to another innerHTML, this would result in an XSS vulnerability. Two WYSIWYG editors were identified with this behavior, more may exist. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.

XSS

Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3

CVE-2019-17024 8.8 - High - January 08, 2020

Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.

Classic Buffer Overflow

Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox ESR 68.1

CVE-2019-11764 8.8 - High - January 08, 2020

Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox ESR 68.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.

Dangling pointer