Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

9 records

Release: Mozilla Firefox 100 Clear all filters
TI-2022-12269 CVE-2022-29918 · GHSA-rf5c-p2xm-2r64

Out-of-bounds write in Mozilla Firefox

Priority MEDIUM 41

Mozilla developers Gabriele Svelto, Randell Jesup and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 99.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00561 Published 2022-12-22 Fixed in 100 CWE-787
TI-2022-12268 CVE-2022-29917 · GHSA-gfq4-pq7x-mq8c

Out-of-bounds write in Mozilla Thunderbird

Priority MEDIUM 51

Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 99 and Firefox ESR 91.8.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01054 Published 2022-12-22 Partial fix · 91.9, 100 CWE-787
TI-2022-12267 CVE-2022-29916 · GHSA-fv4x-hrpq-wqgp

Information disclosure in Mozilla Thunderbird

Priority LOW 30

Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00758 Published 2022-12-22 Partial fix · 91.9, 100 CWE-200
TI-2022-12266 CVE-2022-29915 · GHSA-r7fp-wxjp-2rf9

Origin validation error in Mozilla Firefox

Priority LOW 20

The Performance API did not properly hide the fact whether a request cross-origin resource has observed redirects.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00298 Published 2022-12-22 Fixed in 100 CWE-346
TI-2022-12265 CVE-2022-29914 · GHSA-wmwv-wgqw-75xr

Clickjacking in Mozilla Thunderbird

Priority LOW 30

When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have enabled browser spoofing attacks.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00661 Published 2022-12-22 Partial fix · 91.9, 100 CWE-1021
TI-2022-12263 CVE-2022-29912 · GHSA-qf7x-w4mc-mcp8

Open redirect in Mozilla Thunderbird

Priority LOW 28

Requests initiated through reader mode did not properly omit cookies with a SameSite attribute.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00675 Published 2022-12-22 Partial fix · 91.9, 100 CWE-601
TI-2022-12262 CVE-2022-29911 · GHSA-2pjx-v75h-827m

Clickjacking in Mozilla Thunderbird

Priority LOW 28

An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could lead to script execution without <code>allow-scripts</code> being present.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00613 Published 2022-12-22 Partial fix · 91.9, 100 CWE-1021
TI-2022-12261 CVE-2022-29910 · GHSA-3gq8-8fwh-fc7q

Open redirect in Mozilla Firefox

Priority MEDIUM 60

When closed or sent to the background, Firefox for Android would not properly record and persist HSTS settings.<br>*Note: This issue only affected Firefox for Android.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00371 Published 2022-12-22 Fixed in 100 CWE-601
TI-2022-12260 CVE-2022-29909 · GHSA-557q-69q9-3wvh

Incorrect default permissions in Mozilla Thunderbird

Priority HIGH 73

Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level origin, bypassing the existing prompt and wrongfully inheriting the top-level permissions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00889 Published 2022-12-22 Partial fix · 91.9, 100 CWE-276