Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability

Mozilla Firefox Use-After-Free Vulnerability

Mozilla Firefox Use-After-Free Vulnerability

It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox

The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such as executing scripts or navigating the top-level frame

The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape

The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape

An earlier fix for an Inter-process Communication (IPC) vulnerability, CVE-2011-3079, added authentication to communication between IPC endpoints and server parents during IPC…

Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1

A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an exploitable type confusion vulnerability

The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected at the right point between two passes

A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as the `with` environment

Memory safety bugs present in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3

Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2

If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointer twice, resulting in a use-after-free and a potentially…

A compromised content process could have provided malicious data to `FilterNodeD2D1` resulting in an out-of-bounds write, leading to a potentially exploitable crash in a…

Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0

Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12

A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as .lnk with .download

An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable crash

A use-after-free in WebGL extensions could have led to a potentially exploitable crash

If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while references to it lived on in a BaseShape

Session history navigations may have led to a use-after-free and potentially exploitable crash

Mozilla developers Andrew McCreight, Nicolas B

A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially exploitable crash

A malicious website could have learned the size of a cross-origin resource that supported Range requests

Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 99 and Firefox ESR 91.8

Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian Holler, and Masayuki Nakano reported memory safety bugs present in…

An out of date graphics library (Angle) likely contained vulnerabilities that could potentially be exploited

Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3

A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC

Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR 68.7

Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 74 and Firefox ESR 68.6

Mozilla developers reported memory safety bugs present in Firefox and Thunderbird 68.5

A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use

A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash

Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6

A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed

A vulnerability where type-confusion in the IonMonkey just-in-time (JIT) compiler could potentially be used by malicious JavaScript to trigger a potentially exploitable crash

When manipulating user events in nested loops while opening a document through script, it is possible to trigger a potentially exploitable crash due to poor event handling

A potential vulnerability leading to an integer overflow can occur during buffer size calculations for images when a raw value is used instead of the checked value

A buffer overflow can occur in the Skia library during buffer offset calculations with hardware accelerated canvas 2D actions due to the use of 32-bit calculations instead of…

A use-after-free vulnerability can occur after deleting a selection element due to a weak reference to the select element in the options collection

Mozilla developers and community members reported memory safety bugs present in Firefox 63 and Firefox ESR 60.3

Mozilla developers and community members reported memory safety bugs present in Firefox 62 and Firefox ESR 60.2

Mozilla developers and community members reported memory safety bugs present in Firefox 64 and Firefox ESR 60.4

A use-after-free vulnerability can occur while parsing an HTML5 stream in concert with custom HTML elements

Memory safety bugs present in Firefox 60, Firefox ESR 60, and Firefox ESR 52.8

A buffer overflow can occur when the image renderer attempts to paint non-displayable SVG elements

A use-after-free vulnerability can occur when reading an image observer during frame reconstruction after the observer has been freed