firefox vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the firefox package. This does not include vulnerabilities belonging to this package’s dependencies.

How to fix?

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Fix for free
VulnerabilityVulnerable Version
  • M
Use After Free

<99.0-r0
  • M
Use After Free

<99.0-r0
  • M
Improper Restriction of Rendered UI Layers or Frames

<99.0-r0
  • H
Out-of-bounds Write

<98.0-r0
  • M
CVE-2022-28283

<99.0-r0
  • M
CVE-2022-26383

<98.0-r0
  • H
Out-of-bounds Write

<99.0-r0
  • C
Use After Free

<97.0.2-r0
  • C
CVE-2022-26384

<98.0-r0
  • H
Out-of-bounds Write

<99.0-r0
  • H
Use After Free

<97.0.2-r0
  • M
Out-of-bounds Read

<99.0-r0
  • M
Origin Validation Error

<97.0-r0
  • M
CVE-2022-22739

<97.0-r0
  • H
Time-of-check Time-of-use (TOCTOU)

<98.0-r0
  • M
Information Exposure

<98.0-r0
  • M
Use After Free

<98.0-r0
  • H
Improper Encoding or Escaping of Output

<97.0-r0
  • M
CVE-2022-22750

<97.0-r0
  • M
CVE-2022-22743

<97.0-r0
  • M
CVE-2022-22748

<97.0-r0
  • H
Time-of-check Time-of-use (TOCTOU)

<97.0-r0
  • H
CVE-2022-28284

<99.0-r0
  • H
Out-of-bounds Write

<97.0-r0
  • M
Race Condition

<97.0-r0
  • M
Information Exposure

<97.0-r0
  • H
Race Condition

<97.0-r0
  • H
Inefficient Regular Expression Complexity

<99.0-r0
  • M
CVE-2022-28287

<99.0-r0
  • H
Use After Free

<97.0-r0
  • M
CVE-2022-22745

<97.0-r0
  • M
CVE-2022-22749

<97.0-r0
  • H
Out-of-bounds Write

<97.0-r0
  • H
Out-of-bounds Write

<99.0-r0
  • M
Excessive Iteration

<95.0-r0
  • M
Race Condition

<95.0-r0
  • H
Uncontrolled Search Path Element

<97.0-r0
  • M
Information Exposure

<95.0-r0
  • M
CVE-2022-22762

<97.0-r0
  • H
Use After Free

<95.0-r0
  • M
Improper Restriction of Rendered UI Layers or Frames

<94.0-r0
  • H
CVE-2021-38510

<94.0-r0
  • M
Cross-site Scripting (XSS)

<95.0-r0
  • H
Incorrect Type Conversion or Cast

<95.0-r0
  • H
CVE-2022-22761

<97.0-r0
  • H
Use After Free

<98.0-r0
  • M
CVE-2021-43541

<95.0-r0
  • M
Information Exposure

<95.0-r0
  • H
Cleartext Transmission of Sensitive Information

<97.0-r0
  • C
XML Injection

<97.0-r0
  • H
Use After Free

<94.0-r0
  • C
Incorrect Authorization

<94.0-r0
  • M
CVE-2021-43540

<95.0-r0
  • H
CVE-2022-22741

<97.0-r0
  • M
Out-of-bounds Read

<97.0-r0
  • H
CVE-2022-22756

<97.0-r0
  • M
Origin Validation Error

<94.0-r0
  • H
Out-of-Bounds

<92.0.1-r0
  • M
Improper Restriction of Excessive Authentication Attempts

<92.0.1-r0
  • H
CVE-2021-38499

<93.0-r0
  • H
CVE-2021-29984

<92.0.1-r0
  • C
Race Condition

<93.0-r0
  • C
CVE-2022-22759

<97.0-r0
  • H
CVE-2021-29981

<92.0.1-r0
  • H
Missing Initialization of Resource

<92.0.1-r0
  • H
Out-of-bounds Write

<97.0-r0
  • H
Out-of-bounds Write

<97.0-r0
  • M
CVE-2021-38491

<92.0.1-r0
  • M
Exposure of Resource to Wrong Sphere

<94.0-r0
  • M
Improper Restriction of Rendered UI Layers or Frames

<94.0-r0
  • H
Use After Free

<92.0.1-r0
  • M
Improper Restriction of Rendered UI Layers or Frames

<95.0-r0
  • H
Out-of-bounds Write

<92.0.1-r0
  • M
Origin Validation Error

<93.0-r0
  • H
Operation on a Resource after Expiration or Release

<97.0-r0
  • M
Improper Restriction of Rendered UI Layers or Frames

<94.0-r0
  • H
Out-of-bounds Write

<97.0-r0
  • M
Incorrect Authorization

<97.0-r0
  • M
Cross-site Scripting (XSS)

<95.0-r0
  • H
Use After Free

<90.0-r0
  • M
Improper Certificate Validation

<97.0-r0
  • H
HTTP Request Smuggling

<92.0.1-r0
  • H
Out-of-bounds Write

<90.0-r0
  • H
Interpretation Conflict

<92.0.1-r0
  • M
Missing Release of Resource after Effective Lifetime

<92.0.1-r0
  • H
Use After Free

<93.0-r0
  • M
Incorrect Resource Transfer Between Spheres

<89.0-r0
  • H
CVE-2021-38494

<92.0.1-r0
  • H
Use After Free

<90.0-r0
  • H
CVE-2021-38500

<93.0-r0
  • H
Out-of-bounds Write

<90.0-r0
  • M
Improper Resource Shutdown or Release

<89.0-r0
  • H
Arbitrary Argument Injection

<88.0-r0
  • M
Cross-site Scripting (XSS)

<88.0-r0
  • M
Insufficient Verification of Data Authenticity

<89.0-r0
  • H
CVE-2021-29993

<92.0.1-r0
  • L
CVE-2021-24000

<88.0-r0
  • H
Out-of-Bounds

<89.0-r0
  • M
CVE-2021-38492

<92.0.1-r0
  • M
Incorrect Authorization

<89.0-r0
  • H
Improper Restriction of Rendered UI Layers or Frames

<87.0-r0
  • M
Inadequate Encryption Strength

<87.0-r0
  • M
CVE-2021-29975

<90.0-r0
  • M
Exposure of Resource to Wrong Sphere

<88.0-r0
  • H
Incorrect Conversion between Numeric Types

<88.0-r0
  • H
Out-of-Bounds

<87.0-r0
  • H
CVE-2021-38501

<93.0-r0
  • H
Out-of-bounds Write

<90.0-r0
  • M
CVE-2021-23996

<88.0-r0
  • H
Out-of-Bounds

<88.0-r0
  • H
Use After Free

<93.0-r0
  • H
Out-of-Bounds

<87.0-r0
  • H
Race Condition

<92.0.1-r0
  • M
CVE-2021-29983

<92.0.1-r0
  • H
Improper Privilege Management

<88.0-r0
  • M
Missing Authorization

<89.0-r0
  • M
Externally Controlled Reference to a Resource in Another Sphere

<89.0-r0
  • H
Integer Overflow or Wraparound

<88.0-r0
  • M
CVE-2021-29974

<90.0-r0
  • H
Out-of-Bounds

<89.0-r0
  • M
Insufficient Verification of Data Authenticity

<88.0-r0
  • M
CVE-2021-23969

<87.0-r0
  • M
CVE-2021-23956

<85.0-r0
  • H
Out-of-Bounds

<85.0-r0
  • H
Access of Resource Using Incompatible Type ('Type Confusion')

<85.0-r0
  • H
Out-of-Bounds

<92.0.1-r0
  • M
Time-of-check Time-of-use (TOCTOU)

<87.0-r0
  • M
Exposure of Resource to Wrong Sphere

<87.0-r0
  • M
Authentication Bypass

<87.0-r0
  • M
Information Exposure

<87.0-r0
  • H
CVE-2021-23960

<85.0-r0
  • M
CVE-2021-23971

<87.0-r0
  • H
CVE-2021-23972

<87.0-r0
  • M
Information Exposure

<87.0-r0
  • H
CVE-2021-23957

<85.0-r0
  • M
CVE-2021-23974

<87.0-r0
  • M
Improper Restriction of Rendered UI Layers or Frames

<85.0-r0
  • H
Use After Free

<84.0.2-r0
  • M
Incorrect Calculation

<88.0-r0
  • H
Race Condition

<88.0.1-r0
  • H
Out-of-Bounds

<85.0-r0
  • M
Out-of-Bounds

<87.0-r0
  • M
Origin Validation Error

<87.0-r0
  • H
CVE-2021-23962

<85.0-r0
  • H
Out-of-Bounds

<87.0-r0
  • M
Missing Authorization

<87.0-r0
  • M
CVE-2020-26977

<84.0.1-r0
  • M
Improper Preservation of Permissions

<85.0-r0
  • M
Reachable Assertion

<87.0-r0
  • M
CVE-2020-26978

<84.0.1-r0
  • H
Missing Initialization of Resource

<88.0-r0
  • H
Out-of-bounds Write

<84.0.1-r0
  • H
Out-of-bounds Write

<83.0-r0
  • M
CVE-2020-26975

<84.0.1-r0
  • H
Out-of-bounds Write

<83.0-r0
  • H
Operation on a Resource after Expiration or Release

<88.0-r0
  • H
CVE-2021-23961

<85.0-r0
  • H
Out-of-bounds Write

<84.0.1-r0
  • C
Use After Free

<84.0.1-r0
  • H
Out-of-Bounds

<87.0-r0
  • M
CVE-2020-26966

<83.0-r0
  • M
Reliance on Cookies without Validation and Integrity Checking

<83.0-r0
  • M
CVE-2020-26961

<83.0-r0
  • M
Information Exposure

<84.0.1-r0
  • H
CVE-2021-23978

<87.0-r0
  • M
Improper Cross-boundary Removal of Sensitive Data

<83.0-r0
  • M
Improper Restriction of Rendered UI Layers or Frames

<83.0-r0
  • M
CVE-2020-35111

<84.0.1-r0
  • M
Improper Restriction of Rendered UI Layers or Frames

<83.0-r0
  • H
CVE-2020-26973

<84.0.1-r0
  • H
Use After Free

<83.0-r0
  • H
Out-of-bounds Write

<84.0.1-r0
  • M
Open Redirect

<84.0.1-r0
  • M
Cross-site Scripting (XSS)

<83.0-r0
  • M
CVE-2020-26976

<84.0.1-r0
  • M
CVE-2020-26963

<83.0-r0
  • C
CVE-2020-15684

<82.0-r0
  • M
Out-of-bounds Write

<83.0-r0
  • H
Out-of-bounds Write

<84.0.1-r0
  • M
CVE-2020-26954

<83.0-r0
  • M
CVE-2020-15680

<82.0-r0
  • M
Cross-site Scripting (XSS)

<85.0-r0
  • M
Cross-site Scripting (XSS)

<83.0-r0
  • M
CVE-2020-26967

<83.0-r0
  • M
Exposure of Resource to Wrong Sphere

<85.0-r0
  • M
CVE-2020-26964

<83.0-r0
  • M
Improper Initialization

<83.0-r0
  • M
CVE-2020-16012

<83.0-r0
  • M
Use of a Broken or Risky Cryptographic Algorithm

<80.0-r0
  • H
CVE-2020-35112

<84.0.1-r0
  • H
Use After Free

<83.0-r0
  • H
Out-of-bounds Write

<83.0-r0
  • M
CVE-2020-15665

<80.0-r0
  • H
Use After Free

<82.0-r0
  • C
CVE-2020-15683

<82.0-r0
  • C
Out-of-Bounds

<82.0-r0
  • M
Cross-site Scripting (XSS)

<81.0-r0
  • H
CVE-2020-15681

<82.0-r0
  • M
Open Redirect

<81.0-r0
  • H
Buffer Overflow

<81.0-r0
  • H
Out-of-bounds Write

<79.0-r0
  • M
CVE-2020-6514

<79.0-r0
  • M
Origin Validation Error

<82.0-r0
  • H
Release of Invalid Pointer or Reference

<81.0-r0
  • H
Use After Free

<81.0-r0
  • H
Release of Invalid Pointer or Reference

<81.0-r0
  • H
Unrestricted Upload of File with Dangerous Type

<80.0-r0
  • M
Incorrect Default Permissions

<78.0-r0
  • M
CVE-2020-6829

<80.0-r0
  • H
Use After Free

<78.0-r0
  • M
Loop with Unreachable Exit Condition ('Infinite Loop')

<79.0-r0
  • H
Use After Free

<82.0.3-r0
  • M
Improper Check for Unusual or Exceptional Conditions

<79.0-r0
  • M
Information Exposure

<80.0-r0
  • H
Improper Privilege Management

<80.0-r0
  • M
Incorrect Authorization

<80.0-r0
  • M
Information Exposure

<80.0-r0
  • H
Out-of-Bounds

<78.0-r0
  • H
Release of Invalid Pointer or Reference

<80.0-r0
  • H
Access of Resource Using Incompatible Type ('Type Confusion')

<79.0-r0
  • M
Information Exposure

<79.0-r0
  • M
Improper Locking

<80.0-r0
  • H
Use After Free

<79.0-r0
  • M
CVE-2020-15653

<79.0-r0
  • H
Use After Free

<78.0-r0
  • H
Uncontrolled Search Path Element

<79.0-r0
  • M
Use of a Broken or Risky Cryptographic Algorithm

<78.0-r0
  • H
Out-of-Bounds

<77.0-r0
  • M
Information Exposure

<77.0-r0
  • H
Improper Input Validation

<76.0-r0
  • H
Race Condition

<76.0-r0
  • H
Use After Free

<78.0-r0
  • M
Origin Validation Error

<79.0-r0
  • M
Out-of-bounds Read

<78.0-r0
  • H
Out-of-Bounds

<78.0-r0
  • C
Improper Input Validation

<76.0-r0
  • C
Improper Input Validation

<76.0-r0
  • L
Improper Input Validation

<76.0-r0
  • M
Improper Certificate Validation

<78.0-r0
  • H
Uncontrolled Search Path Element

<78.0-r0
  • H
Insufficient Verification of Data Authenticity

<77.0-r0
  • H
Arbitrary Code Injection

<76.0-r0
  • M
Arbitrary Code Injection

<77.0-r0
  • H
CVE-2020-12409

<77.0-r0
  • M
Authentication Bypass

<74.0-r0
  • C
Improper Privilege Management

<75.0-r0
  • C
Out-of-Bounds

<76.0-r0
  • H
Out-of-bounds Write

<78.0-r0
  • C
Deserialization of Untrusted Data

<76.0-r0
  • M
Use After Free

<77.0-r0
  • M
Incorrect Default Permissions

<78.0-r0
  • C
Buffer Overflow

<76.0-r0
  • C
Out-of-Bounds

<75.0-r0
  • H
Out-of-Bounds

<75.0-r0
  • C
Out-of-Bounds

<75.0-r0
  • M
Authentication Bypass

<74.0-r0
  • H
Information Exposure

<74.0-r0
  • M
Out-of-bounds Read

<78.0-r0
  • C
Out-of-Bounds

<76.0-r0
  • M
Information Exposure

<76.0-r0
  • H
Out-of-bounds Read

<74.0-r0
  • M
Information Exposure

<74.0-r0
  • H
Access of Resource Using Incompatible Type ('Type Confusion')

<71.0.1-r0
  • H
Use After Free

<74.0.1-r0
  • M
Information Exposure

<77.0-r0
  • H
Double Free

<74.0.1-r0
  • L
Session Fixation

<75.0-r0
  • H
Out-of-bounds Write

<75.0-r0
  • M
CVE-2020-6813

<74.0-r0
  • M
Out-of-bounds Read

<74.0-r0
  • H
Use After Free

<74.0-r0
  • C
Out-of-Bounds

<74.0-r0
  • H
Out-of-bounds Write

<70.0-r0
  • M
Cross-site Scripting (XSS)

<71.0.1-r0
  • H
Arbitrary Code Injection

<74.0-r0
  • H
Out-of-bounds Read

<70.0-r0
  • H
Buffer Overflow

<71.0.1-r0
  • M
CVE-2023-5729

<119.0-r0
  • C
Out-of-Bounds

<74.0-r0
  • H
Use After Free

<74.0-r0
  • H
Out-of-bounds Write

<70.0-r0
  • H
Buffer Overflow

<70.0-r0
  • H
Use After Free

<70.0-r0
  • M
Cross-site Scripting (XSS)

<70.0-r0
  • M
Improper Restriction of Rendered UI Layers or Frames

<119.0-r0
  • H
CVE-2023-5728

<119.0-r0
  • M
CVE-2023-5725

<119.0-r0
  • H
Use After Free

<70.0-r0
  • C
Out-of-bounds Write

<103.0-r0
  • C
Out-of-bounds Write

<119.0-r0
  • M
Improper Input Validation

<71.0.1-r0
  • H
CVE-2023-5724

<119.0-r0
  • M
Uncontrolled Search Path Element

<103.0-r0
  • M
CVE-2022-34479

<102.0-r0
  • H
Access of Resource Using Incompatible Type ('Type Confusion')

<71.0.1-r0
  • M
CVE-2023-5726

<119.0-r0
  • M
Cross-site Scripting (XSS)

<71.0.1-r0
  • M
Incorrect Default Permissions

<70.0-r0
  • H
Out-of-bounds Write

<71.0.1-r0
  • M
Open Redirect

<103.0-r0
  • M
Improper Authentication

<71.0.1-r0
  • H
CVE-2022-36319

<103.0-r0
  • H
CVE-2022-34477

<102.0-r0
  • M
Information Exposure

<119.0-r0
  • H
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

<102.0-r0
  • M
CVE-2023-5727

<119.0-r0
  • M
CVE-2022-34472

<102.0-r0
  • M
Origin Validation Error

<70.0-r0
  • M
Cross-site Scripting (XSS)

<70.0-r0
  • M
Cross-site Scripting (XSS)

<70.0-r0
  • M
CVE-2022-36317

<103.0-r0
  • M
Race Condition

<70.0-r0
  • H
CVE-2022-34482

<102.0-r0
  • H
Integer Overflow or Wraparound

<102.0-r0
  • M
CVE-2022-36315

<103.0-r0
  • C
Out-of-bounds Write

<119.0-r0
  • C
CVE-2022-34476

<102.0-r0
  • H
Out-of-bounds Write

<103.0-r0
  • M
CVE-2022-34471

<102.0-r0
  • H
Access of Uninitialized Pointer

<102.0-r0
  • M
Open Redirect

<102.0-r0
  • C
Improper Authentication

<68.0.2-r0
  • M
Race Condition

<103.0-r0
  • H
CVE-2022-34483

<102.0-r0
  • M
Improper Input Validation

<70.0-r0
  • C
Out-of-bounds Write

<102.0-r0
  • M
CVE-2023-5723

<119.0-r0
  • C
Out-of-bounds Read

<101.0-r0
  • C
CVE-2022-31748

<101.0-r0
  • H
CVE-2022-31740

<101.0-r0
  • M
Authentication Bypass

<101.0-r0
  • H
Use After Free

<101.0-r0
  • C
Out-of-bounds Write

<101.0-r0
  • C
CVE-2022-31736

<101.0-r0
  • M
Cross-site Scripting (XSS)

<101.0-r0
  • M
Open Redirect

<100.0-r0
  • M
Cross-site Scripting (XSS)

<102.0-r0
  • C
Out-of-bounds Write

<100.0-r0
  • M
CVE-2022-29914

<100.0-r0
  • C
Use After Free

<102.0-r0
  • M
Open Redirect

<100.0-r0
  • M
Improper Restriction of Rendered UI Layers or Frames

<100.0-r0
  • M
Cross-site Scripting (XSS)

<102.0-r0
  • H
Improper Certificate Validation

<102.0-r0
  • H
Incorrect Default Permissions

<100.0-r0
  • H
Use After Free

<102.0-r0
  • M
CVE-2022-29916

<100.0-r0
  • M
CVE-2022-34478

<102.0-r0
  • M
Cross-site Scripting (XSS)

<101.0-r0
  • H
CVE-2022-34468

<102.0-r0
  • M
CVE-2022-31742

<101.0-r0
  • M
Improper Validation of Array Index

<101.0-r0
  • H
CVE-2022-31739

<101.0-r0
  • H
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

<100.0.2-r0
  • H
Use of Uninitialized Resource

<101.0-r0
  • H
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

<100.0.2-r0
  • H
Out-of-bounds Write

<100.0-r0
  • M
CVE-2022-29915

<100.0-r0