CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-25740
https://notcve.org/view.php?id=CVE-2023-25740
After downloading a Windows <code>.scf</code> script from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requests from the operating system. This also had the potential to leak NTLM credentials to the resource.<br>*This bug only affects Firefox for Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 110. • https://bugzilla.mozilla.org/show_bug.cgi?id=1812354 https://www.mozilla.org/security/advisories/mfsa2023-05 •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-32208
https://notcve.org/view.php?id=CVE-2023-32208
Service workers could reveal script base URL due to dynamic `import()`. This vulnerability affects Firefox < 113. • https://bugzilla.mozilla.org/show_bug.cgi?id=1646034 https://security.gentoo.org/glsa/202401-10 https://www.mozilla.org/security/advisories/mfsa2023-16 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-32209
https://notcve.org/view.php?id=CVE-2023-32209
A maliciously crafted favicon could have led to an out of memory crash. This vulnerability affects Firefox < 113. • https://bugzilla.mozilla.org/show_bug.cgi?id=1767194 https://security.gentoo.org/glsa/202401-10 https://www.mozilla.org/security/advisories/mfsa2023-16 • CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-32210
https://notcve.org/view.php?id=CVE-2023-32210
Documents were incorrectly assuming an ordering of principal objects when ensuring we were loading an appropriately privileged principal. In certain circumstances it might have been possible to cause a document to be loaded with a higher privileged principal than intended. This vulnerability affects Firefox < 113. • https://bugzilla.mozilla.org/show_bug.cgi?id=1776755 https://security.gentoo.org/glsa/202401-10 https://www.mozilla.org/security/advisories/mfsa2023-16 •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-32206 – Mozilla: Crash in RLBox Expat driver
https://notcve.org/view.php?id=CVE-2023-32206
An out-of-bound read could have led to a crash in the RLBox Expat driver. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. The Mozilla Foundation Security Advisory describes this flaw as: An out-of-bound read could have led to a crash in the RLBox Expat driver. • https://bugzilla.mozilla.org/show_bug.cgi?id=1824892 https://security.gentoo.org/glsa/202312-03 https://security.gentoo.org/glsa/202401-10 https://www.mozilla.org/security/advisories/mfsa2023-16 https://www.mozilla.org/security/advisories/mfsa2023-17 https://www.mozilla.org/security/advisories/mfsa2023-18 https://access.redhat.com/security/cve/CVE-2023-32206 https://bugzilla.redhat.com/show_bug.cgi?id=2196737 • CWE-125: Out-of-bounds Read •