CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-29537
https://notcve.org/view.php?id=CVE-2023-29537
Multiple race conditions in the font initialization could have led to memory corruption and execution of attacker-controlled code. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112. • https://bugzilla.mozilla.org/show_bug.cgi?id=1823365 https://bugzilla.mozilla.org/show_bug.cgi?id=1824200 https://bugzilla.mozilla.org/show_bug.cgi?id=1825569 https://www.mozilla.org/security/advisories/mfsa2023-13 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-29544
https://notcve.org/view.php?id=CVE-2023-29544
If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused memory corruption and a potentially exploitable crash. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112. • https://bugzilla.mozilla.org/show_bug.cgi?id=1818781 https://www.mozilla.org/security/advisories/mfsa2023-13 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-23600
https://notcve.org/view.php?id=CVE-2023-23600
Per origin notification permissions were being stored in a way that didn't take into account what browsing context the permission was granted in. This lead to the possibility of notifications to be displayed during different browsing sessions.<br>*This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 109. • https://bugzilla.mozilla.org/show_bug.cgi?id=1787034 https://www.mozilla.org/security/advisories/mfsa2023-01 •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-25741
https://notcve.org/view.php?id=CVE-2023-25741
When dragging and dropping an image cross-origin, the image's size could potentially be leaked. This behavior was shipped in 109 and caused web compatibility problems as well as this security concern, so the behavior was disabled until further review. This vulnerability affects Firefox < 110. • https://bugzilla.mozilla.org/show_bug.cgi?id=1437126 https://bugzilla.mozilla.org/show_bug.cgi?id=1812611 https://bugzilla.mozilla.org/show_bug.cgi?id=1813376 https://www.mozilla.org/security/advisories/mfsa2023-05 •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-28163
https://notcve.org/view.php?id=CVE-2023-28163
When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those in the context of the current user. <br>*This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.*. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9. • https://bugzilla.mozilla.org/show_bug.cgi?id=1817768 https://www.mozilla.org/security/advisories/mfsa2023-09 https://www.mozilla.org/security/advisories/mfsa2023-10 https://www.mozilla.org/security/advisories/mfsa2023-11 •