VYPR

apk package

wolfi/firefox

pkg:apk/wolfi/firefox

Vulnerabilities (490)

  • CVE-2025-11713HigOct 14, 2025
    affected < 140.4-r0fixed 140.4-r0

    Insufficient escaping in the “Copy as cURL” feature could have been used to trick a user into executing unexpected code on Windows. This did not affect the application when running on other operating systems. This vulnerability was fixed in Firefox 144, Firefox ESR 140.4, Thunder

  • CVE-2025-11712MedOct 14, 2025
    affected < 140.4-r0fixed 140.4-r0

    A malicious page could have used the type attribute of an OBJECT tag to override the default browser behavior when encountering a web resource served without a content-type. This could have contributed to an XSS on a site that unsafely serves files without a content-type header.

  • CVE-2025-11710CriOct 14, 2025
    affected < 140.4-r0fixed 140.4-r0

    A compromised web process using malicious IPC messages could have caused the privileged browser process to reveal blocks of its memory to the compromised process. This vulnerability was fixed in Firefox 144, Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird 144, and Thunderbird

  • CVE-2025-11709CriOct 14, 2025
    affected < 140.4-r0fixed 140.4-r0

    A compromised web process was able to trigger out of bounds reads and writes in a more privileged process using manipulated WebGL textures. This vulnerability was fixed in Firefox 144, Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4.

  • CVE-2025-11708CriOct 14, 2025
    affected < 140.4-r0fixed 140.4-r0

    Use-after-free in MediaTrackGraphImpl::GetInstance(). This vulnerability was fixed in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4.

  • CVE-2025-11153HigSep 30, 2025
    affected < 143.0.3-r0fixed 143.0.3-r0

    JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 143.0.3.

  • CVE-2025-11152HigSep 30, 2025
    affected < 143.0.3-r0fixed 143.0.3-r0

    Sandbox escape due to integer overflow in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 143.0.3.

  • CVE-2025-10859MedSep 30, 2025
    affected < 0fixed 0

    Cookie storage for non-HTML temporary documents was being shared incorrectly with normal browsing content, allowing information from private tabs to escape Incognito mode even after the user closed all tabs. This vulnerability was fixed in Firefox for iOS 143.1.

  • CVE-2025-10536MedSep 16, 2025
    affected < 140.3-r0fixed 140.3-r0

    Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.

  • CVE-2025-10535HigSep 16, 2025
    affected < 143-r0fixed 143-r0

    Information disclosure, mitigation bypass in the Privacy component in Firefox for Android. This vulnerability was fixed in Firefox 143.

  • CVE-2025-10534HigSep 16, 2025
    affected < 143-r0fixed 143-r0

    Spoofing issue in the Site Permissions component. This vulnerability was fixed in Firefox 143 and Thunderbird 143.

  • CVE-2025-10533HigSep 16, 2025
    affected < 140.3-r0fixed 140.3-r0

    Integer overflow in the SVG component. This vulnerability was fixed in Firefox 143, Firefox ESR 115.28, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.

  • CVE-2025-10532MedSep 16, 2025
    affected < 140.3-r0fixed 140.3-r0

    Incorrect boundary conditions in the JavaScript: GC component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.

  • CVE-2025-10530MedSep 16, 2025
    affected < 143-r0fixed 143-r0

    Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability was fixed in Firefox 143 and Thunderbird 143.

  • CVE-2025-10529MedSep 16, 2025
    affected < 140.3-r0fixed 140.3-r0

    Same-origin policy bypass in the Layout component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.

  • CVE-2025-10528HigSep 16, 2025
    affected < 140.3-r0fixed 140.3-r0

    Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.

  • CVE-2025-9182HigAug 19, 2025
    affected < 140.2-r0fixed 140.2-r0

    Denial-of-service due to out-of-memory in the Graphics: WebRender component. This vulnerability was fixed in Firefox 142, Firefox ESR 140.2, Thunderbird 142, and Thunderbird 140.2.

  • CVE-2025-9181MedAug 19, 2025
    affected < 128.14-r0fixed 128.14-r0

    Uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 142, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2.

  • CVE-2025-9180HigAug 19, 2025
    affected < 128.14-r0fixed 128.14-r0

    Same-origin policy bypass in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 142, Firefox ESR 115.27, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2.

  • CVE-2025-9179CriAug 19, 2025
    affected < 128.14-r0fixed 128.14-r0

    An attacker was able to perform memory corruption in the GMP process which processes encrypted media. This process is also heavily sandboxed, but represents slightly different privileges from the content process. This vulnerability was fixed in Firefox 142, Firefox ESR 115.27, Fi

Page 13 of 25