rpm package
opensuse/MozillaFirefox&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Tumbleweed
Vulnerabilities (2,706)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2021-23987 | Hig | 8.8 | < 92.0-1.2 | 92.0-1.2 | Mar 31, 2021 | Mozilla developers and community members reported memory safety bugs present in Firefox 86 and Firefox ESR 78.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vuln | |
| CVE-2021-23986 | Med | 6.5 | < 92.0-1.2 | 92.0-1.2 | Mar 31, 2021 | A malicious extension with the 'search' permission could have installed a new search engine whose favicon referenced a cross-origin URL. The response to this cross-origin request could have been read by the extension, allowing a same-origin policy bypass by the extension, which s | |
| CVE-2021-23985 | Med | 6.5 | < 92.0-1.2 | 92.0-1.2 | Mar 31, 2021 | If an attacker is able to alter specific about:config values (for example malware running on the user's computer), the Devtools remote debugging feature could have been enabled in a way that was unnoticable to the user. This would have allowed a remote attacker (able to make a di | |
| CVE-2021-23984 | Med | 6.5 | < 92.0-1.2 | 92.0-1.2 | Mar 31, 2021 | A malicious extension could have opened a popup window lacking an address bar. The title of the popup lacking an address bar should not be fully controllable, but in this situation was. This could have been used to spoof a website and attempt to trick the user into providing cred | |
| CVE-2021-23983 | Med | 6.5 | < 92.0-1.2 | 92.0-1.2 | Mar 31, 2021 | By causing a transition on a parent node by removing a CSS rule, an invalid property for a marker could have been applied, resulting in memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 87. | |
| CVE-2021-23982 | Med | 6.5 | < 92.0-1.2 | 92.0-1.2 | Mar 31, 2021 | Using techniques that built on the slipstream research, a malicious webpage could have scanned both an internal network's hosts as well as services running on the user's local machine utilizing WebRTC connections. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and T | |
| CVE-2021-23981 | Hig | 8.1 | < 92.0-1.2 | 92.0-1.2 | Mar 31, 2021 | A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer used to unpack it, resulting in memory corruption and a potentially exploitable information leak or crash. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thun | |
| CVE-2021-23979 | Hig | 8.8 | < 92.0-1.2 | 92.0-1.2 | Feb 26, 2021 | Mozilla developers reported memory safety bugs present in Firefox 85. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 86. | |
| CVE-2021-23978 | Hig | 8.8 | < 92.0-1.2 | 92.0-1.2 | Feb 26, 2021 | Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Fire | |
| CVE-2021-23965 | Hig | 8.8 | < 92.0-1.2 | 92.0-1.2 | Feb 26, 2021 | Mozilla developers reported memory safety bugs present in Firefox 84. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 85. | |
| CVE-2021-23964 | Hig | 8.8 | < 92.0-1.2 | 92.0-1.2 | Feb 26, 2021 | Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Fire | |
| CVE-2021-23977 | Med | 5.3 | < 92.0-1.2 | 92.0-1.2 | Feb 26, 2021 | Firefox for Android suffered from a time-of-check-time-of-use vulnerability that allowed a malicious application to read sensitive data from application directories. Note: This issue is only affected Firefox for Android. Other operating systems are unaffected. This vulnerability | |
| CVE-2021-23963 | Med | 4.3 | < 92.0-1.2 | 92.0-1.2 | Feb 26, 2021 | When sharing geolocation during an active WebRTC share, Firefox could have reset the webRTC sharing state in the user interface, leading to loss of control over the currently granted permission. This vulnerability affects Firefox < 85. | |
| CVE-2021-23962 | Hig | 8.8 | < 92.0-1.2 | 92.0-1.2 | Feb 26, 2021 | Incorrect use of the '' method could have led to a user-after-poison and a potentially exploitable crash. This vulnerability affects Firefox < 85. | |
| CVE-2021-23961 | Hig | 7.4 | < 92.0-1.2 | 92.0-1.2 | Feb 26, 2021 | Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine. This vulnerability affects Firefox < 85. | |
| CVE-2021-23960 | Hig | 8.8 | < 92.0-1.2 | 92.0-1.2 | Feb 26, 2021 | Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially exploitable crash. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7. | |
| CVE-2021-23959 | Med | 6.1 | < 92.0-1.2 | 92.0-1.2 | Feb 26, 2021 | An XSS bug in internal error pages could have led to various spoofing attacks, including other error pages and the address bar. Note: This issue only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 85. | |
| CVE-2021-23958 | Med | 6.5 | < 92.0-1.2 | 92.0-1.2 | Feb 26, 2021 | The browser could have been confused into transferring a screen sharing state into another tab, which would leak unintended information. This vulnerability affects Firefox < 85. | |
| CVE-2021-23957 | Hig | 7.4 | < 92.0-1.2 | 92.0-1.2 | Feb 26, 2021 | Navigations through the Android-specific `intent` URL scheme could have been misused to escape iframe sandbox. Note: This issue only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 85. | |
| CVE-2021-23956 | Med | 6.5 | < 92.0-1.2 | 92.0-1.2 | Feb 26, 2021 | An ambiguous file picker design could have confused users who intended to select and upload a single file into uploading a whole directory. This was addressed by adding a new prompt. This vulnerability affects Firefox < 85. |
- affected < 92.0-1.2fixed 92.0-1.2
Mozilla developers and community members reported memory safety bugs present in Firefox 86 and Firefox ESR 78.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vuln
- affected < 92.0-1.2fixed 92.0-1.2
A malicious extension with the 'search' permission could have installed a new search engine whose favicon referenced a cross-origin URL. The response to this cross-origin request could have been read by the extension, allowing a same-origin policy bypass by the extension, which s
- affected < 92.0-1.2fixed 92.0-1.2
If an attacker is able to alter specific about:config values (for example malware running on the user's computer), the Devtools remote debugging feature could have been enabled in a way that was unnoticable to the user. This would have allowed a remote attacker (able to make a di
- affected < 92.0-1.2fixed 92.0-1.2
A malicious extension could have opened a popup window lacking an address bar. The title of the popup lacking an address bar should not be fully controllable, but in this situation was. This could have been used to spoof a website and attempt to trick the user into providing cred
- affected < 92.0-1.2fixed 92.0-1.2
By causing a transition on a parent node by removing a CSS rule, an invalid property for a marker could have been applied, resulting in memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 87.
- affected < 92.0-1.2fixed 92.0-1.2
Using techniques that built on the slipstream research, a malicious webpage could have scanned both an internal network's hosts as well as services running on the user's local machine utilizing WebRTC connections. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and T
- affected < 92.0-1.2fixed 92.0-1.2
A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer used to unpack it, resulting in memory corruption and a potentially exploitable information leak or crash. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thun
- affected < 92.0-1.2fixed 92.0-1.2
Mozilla developers reported memory safety bugs present in Firefox 85. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 86.
- affected < 92.0-1.2fixed 92.0-1.2
Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Fire
- affected < 92.0-1.2fixed 92.0-1.2
Mozilla developers reported memory safety bugs present in Firefox 84. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 85.
- affected < 92.0-1.2fixed 92.0-1.2
Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Fire
- affected < 92.0-1.2fixed 92.0-1.2
Firefox for Android suffered from a time-of-check-time-of-use vulnerability that allowed a malicious application to read sensitive data from application directories. Note: This issue is only affected Firefox for Android. Other operating systems are unaffected. This vulnerability
- affected < 92.0-1.2fixed 92.0-1.2
When sharing geolocation during an active WebRTC share, Firefox could have reset the webRTC sharing state in the user interface, leading to loss of control over the currently granted permission. This vulnerability affects Firefox < 85.
- affected < 92.0-1.2fixed 92.0-1.2
Incorrect use of the '' method could have led to a user-after-poison and a potentially exploitable crash. This vulnerability affects Firefox < 85.
- affected < 92.0-1.2fixed 92.0-1.2
Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine. This vulnerability affects Firefox < 85.
- affected < 92.0-1.2fixed 92.0-1.2
Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially exploitable crash. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7.
- affected < 92.0-1.2fixed 92.0-1.2
An XSS bug in internal error pages could have led to various spoofing attacks, including other error pages and the address bar. Note: This issue only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 85.
- affected < 92.0-1.2fixed 92.0-1.2
The browser could have been confused into transferring a screen sharing state into another tab, which would leak unintended information. This vulnerability affects Firefox < 85.
- affected < 92.0-1.2fixed 92.0-1.2
Navigations through the Android-specific `intent` URL scheme could have been misused to escape iframe sandbox. Note: This issue only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 85.
- affected < 92.0-1.2fixed 92.0-1.2
An ambiguous file picker design could have confused users who intended to select and upload a single file into uploading a whole directory. This was addressed by adding a new prompt. This vulnerability affects Firefox < 85.
Page 61 of 136