| CVE-2025-1009 |
An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash
|
9.8
Critical
|
Feb 4, 2025 |
| CVE-2025-0242 |
Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18,…
|
6.5
Medium
|
Jan 7, 2025 |
| CVE-2025-0247 |
Memory safety bugs present in Firefox 133 and Thunderbird 133
|
9.8
Critical
|
Jan 7, 2025 |
| CVE-2025-0243 |
Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5
|
5.1
Medium
|
Jan 7, 2025 |
| CVE-2025-0241 |
When segmenting specially crafted text, segmentation would corrupt memory leading to a potentially exploitable crash
|
7.7
High
|
Jan 7, 2025 |
| CVE-2025-0240 |
Parsing a JavaScript module as JSON could, under some circumstances, cause cross-compartment access, which may result in…
|
4.0
Medium
|
Jan 7, 2025 |
| CVE-2025-0239 |
When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure…
|
4.0
Medium
|
Jan 7, 2025 |
| CVE-2025-0238 |
Assuming a controlled failed memory allocation, an attacker could have caused a use-after-free, leading to a potentially…
|
5.3
Medium
|
Jan 7, 2025 |
| CVE-2025-0237 |
The WebChannel API, which is used to transport various information across processes, did not check the sending principal…
|
5.4
Medium
|
Jan 7, 2025 |
| CVE-2025-0246 |
When using an invalid protocol scheme, an attacker could spoof the address bar
|
6.5
Medium
|
Jan 7, 2025 |
| CVE-2025-0245 |
Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been…
|
3.3
Low
|
Jan 7, 2025 |
| CVE-2025-0244 |
When redirecting to an invalid protocol scheme, an attacker could spoof the address bar
|
5.3
Medium
|
Jan 7, 2025 |
| CVE-2024-11699 |
Memory safety bugs present in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4
|
8.8
High
|
Nov 26, 2024 |
| CVE-2024-11708 |
Missing thread synchronization primitives could have led to a data race on members of the PlaybackParams structure
|
6.5
Medium
|
Nov 26, 2024 |
| CVE-2024-11706 |
A null pointer dereference may have inadvertently occurred in `pk12util`, and specifically in the…
|
6.5
Medium
|
Nov 26, 2024 |
| CVE-2024-11705 |
`NSC_DeriveKey` inadvertently assumed that the `phKey` parameter is always non-NULL
|
9.1
Critical
|
Nov 26, 2024 |
| CVE-2024-11698 |
A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in fullscreen…
|
9.8
Critical
|
Nov 26, 2024 |
| CVE-2024-11696 |
The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature…
|
5.4
Medium
|
Nov 26, 2024 |
| CVE-2024-11704 |
A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path
|
9.8
Critical
|
Nov 26, 2024 |
| CVE-2024-11697 |
When handling keypress events, an attacker may have been able to trick a user into bypassing the "Open Executable File?"…
|
8.8
High
|
Nov 26, 2024 |
| CVE-2024-11695 |
A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page,…
|
5.4
Medium
|
Nov 26, 2024 |
| CVE-2024-11703 |
On Android, Firefox may have inadvertently allowed viewing saved passwords without the required device PIN…
|
5.7
Medium
|
Nov 26, 2024 |
| CVE-2024-11702 |
Copying sensitive information from Private Browsing tabs on Android, such as passwords, may have inadvertently stored…
|
7.5
High
|
Nov 26, 2024 |
| CVE-2024-11694 |
Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and DOM-based XSS…
|
6.1
Medium
|
Nov 26, 2024 |
| CVE-2024-11693 |
The executable file warning was not presented when downloading .library-ms files
|
9.8
Critical
|
Nov 26, 2024 |