| CVE-2025-1020 |
Memory safety bugs present in Firefox 134 and Thunderbird 134
|
9.8
Critical
|
Feb 4, 2025 |
| CVE-2025-1017 |
Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6
|
9.8
Critical
|
Feb 4, 2025 |
| CVE-2025-1016 |
Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19,…
|
9.8
Critical
|
Feb 4, 2025 |
| CVE-2025-0510 |
Thunderbird displayed an incorrect sender address if the From field of an email used the invalid group name syntax…
|
6.5
Medium
|
Feb 4, 2025 |
| CVE-2025-1014 |
Certificate length was not properly checked when added to a certificate store
|
8.8
High
|
Feb 4, 2025 |
| CVE-2025-1013 |
A race condition could have led to private browsing tabs being opened in normal browsing windows
|
6.5
Medium
|
Feb 4, 2025 |
| CVE-2025-1019 |
The z-order of the browser windows could be manipulated to hide the fullscreen notification
|
4.3
Medium
|
Feb 4, 2025 |
| CVE-2025-1012 |
A race during concurrent delazification could have led to a use-after-free
|
9.8
Critical
|
Feb 4, 2025 |
| CVE-2025-1011 |
A bug in WebAssembly code generation could have lead to a crash
|
9.8
Critical
|
Feb 4, 2025 |
| CVE-2025-1010 |
An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash
|
9.8
Critical
|
Feb 4, 2025 |
| CVE-2025-1018 |
The fullscreen notification is prematurely hidden when fullscreen is re-requested quickly by the user
|
7.3
High
|
Feb 4, 2025 |
| CVE-2025-1009 |
An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash
|
9.8
Critical
|
Feb 4, 2025 |
| CVE-2025-0242 |
Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18,…
|
6.5
Medium
|
Jan 7, 2025 |
| CVE-2025-0247 |
Memory safety bugs present in Firefox 133 and Thunderbird 133
|
9.8
Critical
|
Jan 7, 2025 |
| CVE-2025-0243 |
Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5
|
5.1
Medium
|
Jan 7, 2025 |
| CVE-2025-0241 |
When segmenting specially crafted text, segmentation would corrupt memory leading to a potentially exploitable crash
|
7.7
High
|
Jan 7, 2025 |
| CVE-2025-0240 |
Parsing a JavaScript module as JSON could, under some circumstances, cause cross-compartment access, which may result in…
|
4.0
Medium
|
Jan 7, 2025 |
| CVE-2025-0239 |
When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure…
|
4.0
Medium
|
Jan 7, 2025 |
| CVE-2025-0238 |
Assuming a controlled failed memory allocation, an attacker could have caused a use-after-free, leading to a potentially…
|
5.3
Medium
|
Jan 7, 2025 |
| CVE-2025-0237 |
The WebChannel API, which is used to transport various information across processes, did not check the sending principal…
|
5.4
Medium
|
Jan 7, 2025 |
| CVE-2024-11699 |
Memory safety bugs present in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4
|
8.8
High
|
Nov 26, 2024 |
| CVE-2024-11708 |
Missing thread synchronization primitives could have led to a data race on members of the PlaybackParams structure
|
6.5
Medium
|
Nov 26, 2024 |
| CVE-2024-11706 |
A null pointer dereference may have inadvertently occurred in `pk12util`, and specifically in the…
|
6.5
Medium
|
Nov 26, 2024 |
| CVE-2024-11705 |
`NSC_DeriveKey` inadvertently assumed that the `phKey` parameter is always non-NULL
|
9.1
Critical
|
Nov 26, 2024 |
| CVE-2024-11698 |
A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in fullscreen…
|
9.8
Critical
|
Nov 26, 2024 |