CVE-2021-23995

Mozilla: Use-after-free in Responsive Design Mode

When Responsive Design Mode was enabled, it used references to objects that were previously freed. We presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.

CVSS 3.1 · 8.8 High EPSS 1.2% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Thunderbird and 2 more

CVE-2021-23994

Mozilla: Out of bound write due to lazy initialization

A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88.

CVSS 3.1 · 8.8 High EPSS 1.8% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Thunderbird and 2 more

CVE-2021-23987

Mozilla: Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9

Mozilla developers and community members reported memory safety bugs present in Firefox 86 and Firefox ESR 78.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9.

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Thunderbird and 2 more

CVE-2021-23984

Mozilla: Malicious extensions could have spoofed popup information

A malicious extension could have opened a popup window lacking an address bar. The title of the popup lacking an address bar should not be fully controllable, but in this situation was. This could have been used to spoof a website and attempt to trick the user into providing credentials. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Thunderbird and 2 more

CVE-2021-23982

Mozilla: Internal network hosts could have been probed by a malicious webpage

Using techniques that built on the slipstream research, a malicious webpage could have scanned both an internal network's hosts as well as services running on the user's local machine utilizing WebRTC connections. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Thunderbird and 2 more

CVE-2021-23981

Mozilla: Texture upload into an unbound backing buffer resulted in an out-of-bound read

A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer used to unpack it, resulting in memory corruption and a potentially exploitable information leak or crash. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9.

CVSS 3.1 · 8.1 High EPSS 1.1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Thunderbird and 2 more

CVE-2021-23978

Mozilla: Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8

Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8.

CVSS 3.1 · 8.8 High EPSS 1.5% KEV · Not listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Firefox Esr and 3 more

CVE-2021-23973

Mozilla: MediaError message property could have leaked information about cross-origin resources

When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted, and the content of that error may have revealed information about the resource. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8.

CVSS 3.1 · 6.5 Medium EPSS 1.4% KEV · Not listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Firefox Esr and 3 more

CVE-2021-23969

Mozilla: Content Security Policy violation report could have contained the destination of a redirect

As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested by the page, pre-redirects. If that’s not possible, user agents need to strip the URL down to an origin to avoid unintentional leakage." Under certain types of redirects, Firefox incorrectly set the source file to be the destination of the redirects. This was fixed to be the redirect destination's origin. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8.

CVSS 3.1 · 4.3 Medium EPSS 1.2% KEV · Not listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Firefox Esr and 3 more

CVE-2021-23968

Mozilla: Content Security Policy violation report could have contained the destination of a redirect

If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation report; as opposed to the original frame URI. This could be used to leak sensitive information contained in such URIs. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8.

CVSS 3.1 · 4.3 Medium EPSS 1.3% KEV · Not listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Firefox Esr and 3 more

CVE-2021-23964

Mozilla: Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7

Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7.

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Thunderbird and 2 more

CVE-2021-23960

Mozilla: Use-after-poison for incorrectly redeclared JavaScript variables during GC

Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially exploitable crash. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Thunderbird and 2 more

CVE-2021-23954

Mozilla: Type confusion when using logical assignment operators in JavaScript switch statements

Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading to a memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7.

CVSS 3.1 · 8.8 High EPSS 1.2% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Thunderbird and 2 more

CVE-2021-23953

Mozilla: Cross-origin information leakage via redirected PDF requests

If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-origin information, when said information is served as chunked data. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7.

CVSS 3.1 · 4.3 Medium EPSS 1.1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Thunderbird and 2 more

CVE-2020-6831

usrsctp: Buffer overflow in AUTH chunk input validation

A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0.

CVSS 3.1 · 9.8 Critical EPSS 5.8% KEV · Not listed

Vendors

Canonical Debian Mozilla and 2 more

Products

Ubuntu Linux Debian Linux Firefox and 7 more

CVE-2020-6828

Mozilla: Preference overwrite via crafted Intent from malicious Android application

A malicious Android application could craft an Intent that would have been processed by Firefox for Android and potentially result in a file overwrite in the user's profile directory. One exploitation vector for this would be to supply a user.js file providing arbitrary malicious preference values. Control of arbitrary preferences can lead to sufficient compromise such that it is generally equivalent to arbitrary code execution.<br> *Note: This issue only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.7.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed

Vendors

Google Mozilla

Products

Android Firefox Esr

CVE-2020-6827

Mozilla: Custom Tabs in Firefox for Android could have the URI spoofed

When following a link that opened an intent://-schemed URL, causing a custom tab to be opened, Firefox for Android could be tricked into displaying the incorrect URI. <br> *Note: This issue only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.7.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Google Mozilla

Products

Android Firefox Esr

CVE-2020-6825

Mozilla: Memory safety bugs fixed in Firefox 75 and Firefox ESR 68.7

Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 74 and Firefox ESR 68.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75.

CVSS 3.1 · 9.8 Critical EPSS 2.2% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Thunderbird and 2 more

CVE-2020-6822

Mozilla: Out of bounds write in GMPDecodeData when processing large images

On 32-bit builds, an out of bounds write could have occurred when processing an image larger than 4 GB in <code>GMPDecodeData</code>. It is possible that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Thunderbird and 2 more

CVE-2020-6821

Mozilla: Uninitialized memory could be read when using the WebGL copyTexSubImage method

When reading from areas partially or fully outside the source resource with WebGL's <code>copyTexSubImage</code> method, the specification requires the returned values be zero. Previously, this memory was uninitialized, leading to potentially sensitive data disclosure. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Thunderbird and 2 more