| CVE-2022-22761 |
Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors…
|
8.8
High
|
Dec 22, 2022 |
| CVE-2022-22751 |
Mozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele Svelto, Tyson Smith,…
|
8.8
High
|
Dec 22, 2022 |
| CVE-2022-22741 |
When resizing a popup while requesting fullscreen access, the popup would have become unable to leave fullscreen mode
|
7.5
High
|
Dec 22, 2022 |
| CVE-2022-1834 |
When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple…
|
6.5
Medium
|
Dec 22, 2022 |
| CVE-2022-1802 |
If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have…
|
8.8
High
|
Dec 22, 2022 |
| CVE-2022-1520 |
When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both,…
|
4.3
Medium
|
Dec 22, 2022 |
| CVE-2022-1529 |
An attacker could have sent a message to the parent process where the contents were used to double-index into a…
|
8.8
High
|
Dec 22, 2022 |
| CVE-2022-1197 |
When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the…
|
5.4
Medium
|
Dec 22, 2022 |
| CVE-2022-1196 |
After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and…
|
6.5
Medium
|
Dec 22, 2022 |
| CVE-2022-1097 |
NSSToken objects were referenced via direct points, and could have been accessed in an unsafe way on different…
|
6.5
Medium
|
Dec 22, 2022 |
| CVE-2022-0566 |
It may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-bounds write…
|
8.8
High
|
Dec 22, 2022 |
| CVE-2021-4127 |
An out of date graphics library (Angle) likely contained vulnerabilities that could potentially be exploited
|
9.8
Critical
|
Dec 22, 2022 |
| CVE-2021-4126 |
When receiving an OpenPGP/MIME signed email message that contains an additional outer MIME message layer, for example…
|
6.5
Medium
|
Dec 22, 2022 |
| CVE-2021-4140 |
It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox
|
9.8
Critical
|
Dec 22, 2022 |
| CVE-2021-4129 |
Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian Holler,…
|
9.8
Critical
|
Dec 22, 2022 |
| CVE-2020-15685 |
During the plaintext phase of the STARTTLS connection setup, protocol commands could have been injected and evaluated…
|
8.8
High
|
Dec 22, 2022 |
| CVE-2021-38503 |
The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions…
|
Not rated
|
Dec 8, 2021 |
| CVE-2021-38504 |
When interacting with an HTML input element's file picker dialog with webkitdirectory set, a use-after-free could have…
|
Not rated
|
Dec 8, 2021 |
| CVE-2021-38505 |
Microsoft introduced a new feature in Windows 10 known as Cloud Clipboard which, if enabled, will record data copied…
|
Not rated
|
Dec 8, 2021 |
| CVE-2021-38506 |
Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user
|
Not rated
|
Dec 8, 2021 |
| CVE-2021-38507 |
The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently upgraded to TLS while…
|
Not rated
|
Dec 8, 2021 |
| CVE-2021-38508 |
By displaying a form validity message in the correct location at the same time as a permission prompt (such as for…
|
Not rated
|
Dec 8, 2021 |
| CVE-2021-38509 |
Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary (although unstyled)…
|
Not rated
|
Dec 8, 2021 |
| CVE-2021-38510 |
The executable file warning was not presented when downloading .inetloc files, which, due to a flaw in Mac OS, can run…
|
Not rated
|
Dec 8, 2021 |
| CVE-2021-43528 |
Thunderbird unexpectedly enabled JavaScript in the composition area
|
Not rated
|
Dec 8, 2021 |