CVSS: 8.1EPSS: 0%CPEs: 3EXPL: 0CVE-2024-10460 – firefox: thunderbird: Confusing display of origin for external protocol handler prompt
https://notcve.org/view.php?id=CVE-2024-10460
29 Oct 2024 — The origin of an external protocol handler prompt could have been obscured using a data: URL within an `iframe`. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132. The Mozilla Foundation's Security Advisory: The origin of an external protocol handler prompt could be obscured using a data: URL within an `iframe`. Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potent... • https://bugzilla.mozilla.org/show_bug.cgi?id=1912537 • CWE-346: Origin Validation Error CWE-940: Improper Verification of Source of a Communication Channel •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2024-10459 – firefox: thunderbird: Use-after-free in layout with accessibility
https://notcve.org/view.php?id=CVE-2024-10459
29 Oct 2024 — An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially exploitable crash. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firefox ESR < 115.17, Thunderbird < 128.4, and Thunderbird < 132. The Mozilla Foundation's Security Advisory: An attacker could cause a use-after-free when accessibility is enabled, leading to a potentially exploitable crash. Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially... • https://bugzilla.mozilla.org/show_bug.cgi?id=1919087 • CWE-416: Use After Free •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2024-10458 – firefox: thunderbird: Permission leak via embed or object elements
https://notcve.org/view.php?id=CVE-2024-10458
29 Oct 2024 — A permission leak could have occurred from a trusted site to an untrusted site via `embed` or `object` elements. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firefox ESR < 115.17, Thunderbird < 128.4, and Thunderbird < 132. The Mozilla Foundation's Security Advisory: A permission leak could occur from a trusted site to an untrusted site via `embed` or `object` elements. An update for thunderbird is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red... • https://bugzilla.mozilla.org/show_bug.cgi?id=1921733 • CWE-280: Improper Handling of Insufficient Permissions or Privileges CWE-281: Improper Preservation of Permissions •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 0CVE-2024-10004
https://notcve.org/view.php?id=CVE-2024-10004
15 Oct 2024 — Opening an external link to an HTTP website when Firefox iOS was previously closed and had an HTTPS tab open could in some cases result in the padlock icon showing an HTTPS indicator incorrectly This vulnerability affects Firefox for iOS < 131.2. • https://bugzilla.mozilla.org/show_bug.cgi?id=1904885 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2024-9936 – Ubuntu Security Notice USN-7078-1
https://notcve.org/view.php?id=CVE-2024-9936
14 Oct 2024 — When manipulating the selection node cache, an attacker may have been able to cause unexpected behavior, potentially leading to an exploitable crash. This vulnerability affects Firefox < 131.0.3. Atte Kettunen discovered that Firefox did not properly validate before inserting ranges into the selection node cache. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. • https://bugzilla.mozilla.org/show_bug.cgi?id=1920381 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 10.0EPSS: 34%CPEs: 36EXPL: 2CVE-2024-9680 – Mozilla Firefox Use-After-Free Vulnerability
https://notcve.org/view.php?id=CVE-2024-9680
09 Oct 2024 — An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, and Firefox ESR < 115.16.1. An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. • https://github.com/tdonaworth/Firefox-CVE-2024-9680 • CWE-416: Use After Free •
CVSS: 7.6EPSS: 0%CPEs: 19EXPL: 0CVE-2024-9403 – firefox: thunderbird: Memory safety bugs fixed in Firefox 131 and Thunderbird 131
https://notcve.org/view.php?id=CVE-2024-9403
01 Oct 2024 — Memory safety bugs present in Firefox 130. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 131 and Thunderbird < 131. The Mozilla Foundation's Security Advisory: Memory safety bugs present in Firefox 130. Some of these bugs show evidence of memory corruption and we presume that with enough effort, some of these could be exploited to run arbitrary code. • https://bugzilla.mozilla.org/show_bug.cgi?id=1917807 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-9395 – Gentoo Linux Security Advisory 202412-06
https://notcve.org/view.php?id=CVE-2024-9395
01 Oct 2024 — A specially crafted filename containing a large number of spaces could obscure the file's extension when displayed in the download dialog. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 131. A specially crafted filename containing a large number of spaces could obscure the file's extension when displayed in the download dialog. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability... • https://bugzilla.mozilla.org/show_bug.cgi?id=1906024 •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-9391 – Gentoo Linux Security Advisory 202412-06
https://notcve.org/view.php?id=CVE-2024-9391
01 Oct 2024 — A user who enables full-screen mode on a specially crafted web page could potentially be prevented from exiting full screen mode. This may allow spoofing of other sites as the address bar is no longer visible. *This bug only affects Firefox Focus for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 131. A user who enables full-screen mode on a specially crafted web page could potentially be prevented from exiting full screen mode. This may allow spoofing of other site... • https://bugzilla.mozilla.org/show_bug.cgi?id=1892407 • CWE-290: Authentication Bypass by Spoofing •
CVSS: 10.0EPSS: 0%CPEs: 32EXPL: 0CVE-2024-9402 – firefox: thunderbird: Memory safety bugs fixed in Firefox 131, Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3
https://notcve.org/view.php?id=CVE-2024-9402
01 Oct 2024 — Memory safety bugs present in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131. A flaw was found in Mozilla. The Mozilla Foundation's Security Advisory describes the issue as follows: Memory safety bugs are present in Firefox 130, Firefox ESR... • https://bugzilla.mozilla.org/buglist.cgi?bug_id=1872744%2C1897792%2C1911317%2C1913445%2C1914106%2C1914475%2C1914963%2C1915008%2C1916476 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •