Vulnerabilities > Mozilla > Firefox > High

DATE CVE VULNERABILITY TITLE RISK
2022-12-22 CVE-2022-40962 Out-of-bounds Write vulnerability in Mozilla Thunderbird
Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 104 and Firefox ESR 102.2.
network
low complexity
mozilla CWE-787
8.8
2022-12-22 CVE-2022-42927 Origin Validation Error vulnerability in Mozilla Firefox
A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via `performance.getEntries()`.
network
low complexity
mozilla CWE-346
8.1
2022-12-22 CVE-2022-42928 NULL Pointer Dereference vulnerability in Mozilla Firefox
Certain types of allocations were missing annotations that, if the Garbage Collector was in a specific state, could have lead to memory corruption and a potentially exploitable crash.
network
low complexity
mozilla CWE-476
8.8
2022-12-22 CVE-2022-42930 Race Condition vulnerability in Mozilla Firefox
If two Workers were simultaneously initializing their CacheStorage, a data race could have occurred in the `ThirdPartyUtil` component.
network
high complexity
mozilla CWE-362
7.1
2022-12-22 CVE-2022-42932 Out-of-bounds Write vulnerability in Mozilla Firefox
Mozilla developers Ashley Hale and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 105 and Firefox ESR 102.3.
network
low complexity
mozilla CWE-787
8.8
2022-12-22 CVE-2022-45407 Use After Free vulnerability in Mozilla Firefox
If an attacker loaded a font using <code>FontFace()</code> on a background worker, a use-after-free could have occurred, leading to a potentially exploitable crash.
network
low complexity
mozilla CWE-416
7.5
2022-12-22 CVE-2022-45409 Use After Free vulnerability in Mozilla Firefox
The garbage collector could have been aborted in several states and zones and <code>GCRuntime::finishCollection</code> may not have been called, leading to a use-after-free and potentially exploitable crash.
network
low complexity
mozilla CWE-416
8.8
2022-12-22 CVE-2022-45412 Link Following vulnerability in Mozilla Firefox
When resolving a symlink such as <code>file:///proc/self/fd/1</code>, an error message may be produced where the symlink was resolved to a string containing unitialized memory in the buffer.
network
low complexity
mozilla CWE-59
8.8
2022-12-22 CVE-2022-45415 Unspecified vulnerability in Mozilla Firefox
When downloading an HTML file, if the title of the page was formatted as a filename with a malicious extension, Firefox may have saved the file with that extension, leading to possible system compromise if the downloaded file was later ran.
local
low complexity
mozilla
7.8
2022-12-22 CVE-2022-45421 Out-of-bounds Write vulnerability in Mozilla Firefox
Mozilla developers Andrew McCreight and Gabriele Svelto reported memory safety bugs present in Thunderbird 102.4.
network
low complexity
mozilla CWE-787
8.8