Search CVE reports
1271 – 1280 of 2560 results
For native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token was being used for JS-to-native also, but it isn't needed in this case, and its usage...
6 affected packages
firefox, mozjs38, mozjs52, mozjs60, mozjs68, thunderbird
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| firefox | — | — | — | Not in release | Not affected |
| mozjs38 | — | — | — | Not in release | Not affected |
| mozjs52 | — | — | — | Not affected | Not affected |
| mozjs60 | — | — | — | Not in release | Not in release |
| mozjs68 | — | — | — | Not affected | Not in release |
| thunderbird | — | — | — | Not in release | Not affected |
The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it...
6 affected packages
firefox, mozjs38, mozjs52, mozjs60, mozjs68, thunderbird
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| firefox | — | Not affected | Not affected | Not in release | Not affected |
| mozjs38 | — | Not in release | Not in release | Not in release | Ignored |
| mozjs52 | — | Not in release | Not in release | Ignored | Ignored |
| mozjs60 | — | Not in release | Not in release | Not in release | Not in release |
| mozjs68 | — | Not in release | Not in release | Ignored | Not in release |
| thunderbird | — | Not affected | Not affected | Not in release | Not affected |
NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9.
3 affected packages
firefox, nss, thunderbird
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| firefox | — | — | — | Fixed | Fixed |
| nss | — | — | — | Fixed | Fixed |
| thunderbird | — | — | — | Fixed | Fixed |
Some fixes available 15 of 21
Use after free in ANGLE in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
7 affected packages
chromium-browser, firefox, mozjs38, mozjs52, mozjs60...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| chromium-browser | — | Not affected | Not affected | Not in release | Fixed |
| firefox | — | Fixed | Fixed | Fixed | Fixed |
| mozjs38 | — | Not in release | Not in release | Not in release | Ignored |
| mozjs52 | — | Not in release | Not in release | Ignored | Ignored |
| mozjs60 | — | Not in release | Not in release | Not in release | Not in release |
| mozjs68 | — | Not in release | Not in release | Ignored | Not in release |
| thunderbird | — | Not affected | Not affected | Fixed | Fixed |
By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird displays. This vulnerability affects Thunderbird < 68.8.0.
1 affected package
thunderbird
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| thunderbird | — | — | — | Fixed | Fixed |
Some fixes available 26 of 32
A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and...
8 affected packages
mozjs38, mozjs52, chromium-browser, firefox, firefox-esr...
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| mozjs38 | — | Not in release | Not in release | Not in release | Ignored |
| mozjs52 | — | Not in release | Not in release | Ignored | Ignored |
| chromium-browser | — | Not affected | Not affected | Not in release | Fixed |
| firefox | — | Fixed | Fixed | Fixed | Fixed |
| firefox-esr | — | Not in release | Not in release | Not in release | Not in release |
| mozjs60 | — | Not in release | Not in release | Not in release | Not in release |
| mozjs68 | — | Not in release | Not in release | Ignored | Not in release |
| thunderbird | — | Fixed | Fixed | Fixed | Fixed |
Some fixes available 24 of 32
Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR 68.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could...
6 affected packages
firefox, mozjs38, mozjs52, mozjs60, mozjs68, thunderbird
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| firefox | — | Fixed | Fixed | Fixed | Fixed |
| mozjs38 | — | Not in release | Not in release | Not in release | Ignored |
| mozjs52 | — | Not in release | Not in release | Ignored | Ignored |
| mozjs60 | — | Not in release | Not in release | Not in release | Not in release |
| mozjs68 | — | Not in release | Not in release | Ignored | Not in release |
| thunderbird | — | Fixed | Fixed | Fixed | Fixed |
Some fixes available 24 of 32
The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal,...
6 affected packages
firefox, mozjs38, mozjs52, mozjs60, mozjs68, thunderbird
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| firefox | — | Fixed | Fixed | Fixed | Fixed |
| mozjs38 | — | Not in release | Not in release | Not in release | Ignored |
| mozjs52 | — | Not in release | Not in release | Ignored | Ignored |
| mozjs60 | — | Not in release | Not in release | Not in release | Not in release |
| mozjs68 | — | Not in release | Not in release | Ignored | Not in release |
| thunderbird | — | Fixed | Fixed | Fixed | Fixed |
Some fixes available 24 of 32
A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This resulted in a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0.
6 affected packages
firefox, mozjs38, mozjs52, mozjs60, mozjs68, thunderbird
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| firefox | — | Fixed | Fixed | Fixed | Fixed |
| mozjs38 | — | Not in release | Not in release | Not in release | Ignored |
| mozjs52 | — | Not in release | Not in release | Ignored | Ignored |
| mozjs60 | — | Not in release | Not in release | Not in release | Not in release |
| mozjs68 | — | Not in release | Not in release | Ignored | Not in release |
| thunderbird | — | Fixed | Fixed | Fixed | Fixed |
Some fixes available 24 of 32
Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 74 and Firefox ESR 68.6. Some of these bugs showed evidence of memory corruption and we presume that with...
6 affected packages
firefox, mozjs38, mozjs52, mozjs60, mozjs68, thunderbird
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| firefox | — | Fixed | Fixed | Fixed | Fixed |
| mozjs38 | — | Not in release | Not in release | Not in release | Ignored |
| mozjs52 | — | Not in release | Not in release | Ignored | Ignored |
| mozjs60 | — | Not in release | Not in release | Not in release | Not in release |
| mozjs68 | — | Not in release | Not in release | Ignored | Not in release |
| thunderbird | — | Fixed | Fixed | Fixed | Fixed |