Vulnerabilities > Mozilla > Thunderbird > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-06-02 | CVE-2023-25728 | Unspecified vulnerability in Mozilla Firefox ESR The <code>Content-Security-Policy-Report-Only</code> header could allow an attacker to leak a child iframe's unredacted URI when interaction with that iframe triggers a redirect. | 6.5 |
| 2023-06-02 | CVE-2023-25730 | Unspecified vulnerability in Mozilla Firefox ESR A background script invoking <code>requestFullscreen</code> and then blocking the main thread could force the browser into fullscreen mode indefinitely, resulting in potential user confusion or spoofing attacks. | 5.4 |
| 2023-06-02 | CVE-2023-25738 | Out-of-bounds Read vulnerability in Mozilla Firefox Members of the <code>DEVMODEW</code> struct set by the printer device driver weren't being validated and could have resulted in invalid values which in turn would cause the browser to attempt out of bounds access to related variables.<br>*This bug only affects Firefox on Windows. | 6.5 |
| 2023-06-02 | CVE-2023-25742 | Unspecified vulnerability in Mozilla Firefox ESR When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash. | 6.5 |
| 2023-06-02 | CVE-2023-25751 | Unspecified vulnerability in Mozilla Firefox Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritten incorrectly. | 6.5 |
| 2023-06-02 | CVE-2023-25752 | Unspecified vulnerability in Mozilla Firefox When accessing throttled streams, the count of available bytes needed to be checked in the calling function to be within bounds. | 6.5 |
| 2023-06-02 | CVE-2023-28163 | Unspecified vulnerability in Mozilla Firefox When downloading files through the Save As dialog on Windows with suggested filenames containing environment variable names, Windows would have resolved those in the context of the current user. | 6.5 |
| 2023-06-02 | CVE-2023-28164 | Unspecified vulnerability in Mozilla Firefox Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website spoofing attacks. | 6.5 |
| 2023-06-02 | CVE-2023-29533 | Unspecified vulnerability in Mozilla products A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscreen requests, <code>window.name</code> assignments, and <code>setInterval</code> calls. | 4.3 |
| 2023-06-02 | CVE-2023-29535 | Unspecified vulnerability in Mozilla products Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. | 6.5 |