Homepage

firefox vulnerabilities

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the firefox package. This does not include vulnerabilities belonging to this package’s dependencies.

How to fix?

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Fix for free
VulnerabilityVulnerable Version
  • M
Improper Restriction of Rendered UI Layers or Frames

<99.0-r0
  • H
Out-of-bounds Write

<99.0-r0
  • M
Out-of-bounds Read

<99.0-r0
  • H
Out-of-bounds Write

<99.0-r0
  • H
Use After Free

<98.0-r0
  • C
Use After Free

<97.0.2-r0
  • H
Use After Free

<97.0.2-r0
  • H
CVE-2022-22741

<97.0-r0
  • M
Information Exposure

<97.0-r0
  • M
Use After Free

<99.0-r0
  • H
Cleartext Transmission of Sensitive Information

<97.0-r0
  • H
Out-of-bounds Write

<97.0-r0
  • M
CVE-2022-26383

<98.0-r0
  • M
Information Exposure

<98.0-r0
  • M
CVE-2022-22745

<97.0-r0
  • H
CVE-2022-28284

<99.0-r0
  • C
CVE-2022-22759

<97.0-r0
  • H
Out-of-bounds Write

<97.0-r0
  • H
Time-of-check Time-of-use (TOCTOU)

<98.0-r0
  • H
Out-of-bounds Write

<98.0-r0
  • M
Out-of-bounds Read

<97.0-r0
  • M
Improper Restriction of Rendered UI Layers or Frames

<95.0-r0
  • H
Use After Free

<95.0-r0
  • M
Improper Certificate Validation

<97.0-r0
  • H
Out-of-bounds Write

<97.0-r0
  • M
CVE-2022-22750

<97.0-r0
  • C
XML Injection

<97.0-r0
  • M
CVE-2022-22748

<97.0-r0
  • M
Information Exposure

<95.0-r0
  • H
CVE-2022-22756

<97.0-r0
  • H
Out-of-bounds Write

<99.0-r0
  • H
Out-of-bounds Write

<97.0-r0
  • M
CVE-2022-28287

<99.0-r0
  • M
CVE-2022-28283

<99.0-r0
  • H
CVE-2022-22761

<97.0-r0
  • M
Use After Free

<99.0-r0
  • M
CVE-2021-43540

<95.0-r0
  • H
Incorrect Type Conversion or Cast

<95.0-r0
  • M
Race Condition

<97.0-r0
  • H
Out-of-bounds Write

<92.0.1-r0
  • H
Inefficient Regular Expression Complexity

<99.0-r0
  • H
Use After Free

<97.0-r0
  • C
Race Condition

<93.0-r0
  • H
Race Condition

<97.0-r0
  • M
Improper Restriction of Excessive Authentication Attempts

<92.0.1-r0
  • C
CVE-2022-26384

<98.0-r0
  • M
Use After Free

<98.0-r0
  • M
Missing Release of Resource after Effective Lifetime

<92.0.1-r0
  • M
CVE-2021-43541

<95.0-r0
  • M
Information Exposure

<95.0-r0
  • M
CVE-2022-22743

<97.0-r0
  • H
Operation on a Resource after Expiration or Release

<97.0-r0
  • M
Improper Restriction of Rendered UI Layers or Frames

<94.0-r0
  • M
Origin Validation Error

<97.0-r0
  • H
Use After Free

<94.0-r0
  • M
Origin Validation Error

<94.0-r0
  • H
Improper Encoding or Escaping of Output

<97.0-r0
  • M
Cross-site Scripting (XSS)

<95.0-r0
  • M
Improper Restriction of Rendered UI Layers or Frames

<94.0-r0
  • H
CVE-2021-38510

<94.0-r0
  • H
CVE-2021-38494

<92.0.1-r0
  • H
Out-of-bounds Write

<90.0-r0
  • H
Out-of-bounds Write

<97.0-r0
  • M
CVE-2021-29974

<90.0-r0
  • H
Time-of-check Time-of-use (TOCTOU)

<97.0-r0
  • H
CVE-2021-38501

<93.0-r0
  • H
Out-of-Bounds

<89.0-r0
  • M
CVE-2022-22762

<97.0-r0
  • H
Uncontrolled Search Path Element

<97.0-r0
  • H
CVE-2021-38499

<93.0-r0
  • M
CVE-2022-22739

<97.0-r0
  • M
Incorrect Authorization

<97.0-r0
  • M
CVE-2022-22749

<97.0-r0
  • M
Externally Controlled Reference to a Resource in Another Sphere

<89.0-r0
  • M
Improper Resource Shutdown or Release

<89.0-r0
  • H
Arbitrary Argument Injection

<88.0-r0
  • H
CVE-2021-38500

<93.0-r0
  • M
Origin Validation Error

<93.0-r0
  • H
Incorrect Conversion between Numeric Types

<88.0-r0
  • M
CVE-2021-29983

<92.0.1-r0
  • H
Use After Free

<93.0-r0
  • M
CVE-2021-38492

<92.0.1-r0
  • H
Use After Free

<92.0.1-r0
  • H
HTTP Request Smuggling

<92.0.1-r0
  • H
Out-of-Bounds

<92.0.1-r0
  • H
Interpretation Conflict

<92.0.1-r0
  • H
Out-of-Bounds

<92.0.1-r0
  • H
Missing Initialization of Resource

<92.0.1-r0
  • H
Out-of-Bounds

<88.0-r0
  • M
Race Condition

<95.0-r0
  • M
CVE-2021-23996

<88.0-r0
  • M
Insufficient Verification of Data Authenticity

<88.0-r0
  • H
Improper Restriction of Rendered UI Layers or Frames

<87.0-r0
  • M
Cross-site Scripting (XSS)

<95.0-r0
  • M
Excessive Iteration

<95.0-r0
  • M
Improper Restriction of Rendered UI Layers or Frames

<94.0-r0
  • M
Information Exposure

<87.0-r0
  • H
Operation on a Resource after Expiration or Release

<88.0-r0
  • H
Use After Free

<90.0-r0
  • C
Incorrect Authorization

<94.0-r0
  • H
Integer Overflow or Wraparound

<88.0-r0
  • H
Use After Free

<93.0-r0
  • M
Exposure of Resource to Wrong Sphere

<94.0-r0
  • M
Exposure of Resource to Wrong Sphere

<88.0-r0
  • M
Cross-site Scripting (XSS)

<88.0-r0
  • M
Incorrect Authorization

<89.0-r0
  • H
Out-of-Bounds

<89.0-r0
  • H
Out-of-bounds Write

<90.0-r0
  • H
Race Condition

<92.0.1-r0
  • H
CVE-2021-23957

<85.0-r0
  • H
Out-of-Bounds

<85.0-r0
  • M
Out-of-Bounds

<87.0-r0
  • H
Race Condition

<88.0.1-r0
  • M
CVE-2021-38491

<92.0.1-r0
  • M
Improper Restriction of Rendered UI Layers or Frames

<85.0-r0
  • M
Incorrect Calculation

<88.0-r0
  • M
CVE-2021-23971

<87.0-r0
  • H
CVE-2021-29993

<92.0.1-r0
  • H
CVE-2021-29981

<92.0.1-r0
  • L
CVE-2021-24000

<88.0-r0
  • H
Out-of-Bounds

<87.0-r0
  • M
CVE-2021-29975

<90.0-r0
  • H
Use After Free

<90.0-r0
  • M
Missing Authorization

<89.0-r0
  • H
CVE-2021-29984

<92.0.1-r0
  • H
Improper Privilege Management

<88.0-r0
  • H
Missing Initialization of Resource

<88.0-r0
  • H
Out-of-Bounds

<87.0-r0
  • M
Information Exposure

<87.0-r0
  • H
Out-of-bounds Write

<90.0-r0
  • M
CVE-2020-26977

<84.0.1-r0
  • M
Insufficient Verification of Data Authenticity

<89.0-r0
  • M
Incorrect Resource Transfer Between Spheres

<89.0-r0
  • M
Missing Authorization

<87.0-r0
  • M
CVE-2021-23969

<87.0-r0
  • M
Reachable Assertion

<87.0-r0
  • M
Inadequate Encryption Strength

<87.0-r0
  • M
Authentication Bypass

<87.0-r0
  • M
CVE-2021-23974

<87.0-r0
  • H
Out-of-bounds Write

<84.0.1-r0
  • M
CVE-2020-35111

<84.0.1-r0
  • H
Out-of-bounds Write

<84.0.1-r0
  • M
Exposure of Resource to Wrong Sphere

<85.0-r0
  • M
Improper Cross-boundary Removal of Sensitive Data

<83.0-r0
  • H
Out-of-bounds Write

<83.0-r0
  • M
Cross-site Scripting (XSS)

<85.0-r0
  • H
Access of Resource Using Incompatible Type ('Type Confusion')

<85.0-r0
  • H
CVE-2021-23962

<85.0-r0
  • H
Out-of-Bounds

<87.0-r0
  • H
Out-of-Bounds

<85.0-r0
  • H
CVE-2021-23961

<85.0-r0
  • M
Information Exposure

<84.0.1-r0
  • H
Use After Free

<84.0.2-r0
  • H
CVE-2021-23978

<87.0-r0
  • H
Out-of-Bounds

<87.0-r0
  • H
Out-of-bounds Write

<83.0-r0
  • M
Time-of-check Time-of-use (TOCTOU)

<87.0-r0
  • M
Exposure of Resource to Wrong Sphere

<87.0-r0
  • M
CVE-2020-26961

<83.0-r0
  • M
Out-of-bounds Write

<83.0-r0
  • M
Open Redirect

<84.0.1-r0
  • M
Origin Validation Error

<87.0-r0
  • M
Improper Restriction of Rendered UI Layers or Frames

<83.0-r0
  • M
CVE-2021-23956

<85.0-r0
  • H
CVE-2021-23972

<87.0-r0
  • M
CVE-2020-15665

<80.0-r0
  • H
Unrestricted Upload of File with Dangerous Type

<80.0-r0
  • H
Out-of-bounds Write

<84.0.1-r0
  • M
CVE-2020-26963

<83.0-r0
  • M
Improper Preservation of Permissions

<85.0-r0
  • M
CVE-2020-16012

<83.0-r0
  • M
CVE-2020-26967

<83.0-r0
  • M
Cross-site Scripting (XSS)

<83.0-r0
  • M
CVE-2020-26964

<83.0-r0
  • H
CVE-2021-23960

<85.0-r0
  • M
Improper Restriction of Rendered UI Layers or Frames

<83.0-r0
  • C
Use After Free

<84.0.1-r0
  • H
CVE-2020-35112

<84.0.1-r0
  • H
Out-of-bounds Write

<83.0-r0
  • M
CVE-2020-26966

<83.0-r0
  • H
Use After Free

<83.0-r0
  • M
Cross-site Scripting (XSS)

<83.0-r0
  • M
Reliance on Cookies without Validation and Integrity Checking

<83.0-r0
  • M
CVE-2020-15680

<82.0-r0
  • H
Use After Free

<82.0-r0
  • M
Loop with Unreachable Exit Condition ('Infinite Loop')

<79.0-r0
  • M
CVE-2020-26978

<84.0.1-r0
  • H
Access of Resource Using Incompatible Type ('Type Confusion')

<79.0-r0
  • M
CVE-2020-26954

<83.0-r0
  • M
CVE-2020-26976

<84.0.1-r0
  • H
Use After Free

<83.0-r0
  • H
Use After Free

<82.0.3-r0
  • H
Out-of-bounds Write

<84.0.1-r0
  • C
Out-of-Bounds

<82.0-r0
  • M
Open Redirect

<81.0-r0
  • M
Cross-site Scripting (XSS)

<81.0-r0
  • H
Use After Free

<81.0-r0
  • H
Release of Invalid Pointer or Reference

<80.0-r0
  • M
Incorrect Default Permissions

<78.0-r0
  • H
CVE-2020-26973

<84.0.1-r0
  • M
Use of a Broken or Risky Cryptographic Algorithm

<80.0-r0
  • H
Improper Privilege Management

<80.0-r0
  • M
CVE-2020-26975

<84.0.1-r0
  • H
CVE-2020-15681

<82.0-r0
  • M
Improper Initialization

<83.0-r0
  • M
Information Exposure

<77.0-r0
  • M
Origin Validation Error

<82.0-r0
  • H
Out-of-bounds Write

<79.0-r0
  • M
CVE-2020-6829

<80.0-r0
  • M
CVE-2020-15653

<79.0-r0
  • M
Information Exposure

<80.0-r0
  • H
Use After Free

<78.0-r0
  • H
Out-of-Bounds

<77.0-r0
  • H
Uncontrolled Search Path Element

<79.0-r0
  • M
Incorrect Authorization

<80.0-r0
  • C
CVE-2020-15684

<82.0-r0
  • C
CVE-2020-15683

<82.0-r0
  • H
Insufficient Verification of Data Authenticity

<77.0-r0
  • M
Information Exposure

<80.0-r0
  • H
Use After Free

<78.0-r0
  • H
Buffer Overflow

<81.0-r0
  • M
Out-of-bounds Read

<78.0-r0
  • H
Release of Invalid Pointer or Reference

<81.0-r0
  • H
Arbitrary Code Injection

<76.0-r0
  • H
Out-of-bounds Write

<78.0-r0
  • M
Incorrect Default Permissions

<78.0-r0
  • C
Out-of-Bounds

<76.0-r0
  • M
CVE-2020-6514

<79.0-r0
  • M
Improper Locking

<80.0-r0
  • H
Release of Invalid Pointer or Reference

<81.0-r0
  • M
Information Exposure

<74.0-r0
  • M
CVE-2020-6813

<74.0-r0
  • H
Out-of-Bounds

<78.0-r0
  • H
Access of Resource Using Incompatible Type ('Type Confusion')

<71.0.1-r0
  • M
Cross-site Scripting (XSS)

<71.0.1-r0
  • C
Deserialization of Untrusted Data

<76.0-r0
  • H
Use After Free

<78.0-r0
  • M
Use of a Broken or Risky Cryptographic Algorithm

<78.0-r0
  • H
Out-of-Bounds

<75.0-r0
  • C
Out-of-Bounds

<75.0-r0
  • M
Cross-site Scripting (XSS)

<70.0-r0
  • C
Improper Input Validation

<76.0-r0
  • M
Improper Check for Unusual or Exceptional Conditions

<79.0-r0
  • M
Arbitrary Code Injection

<77.0-r0
  • M
Improper Certificate Validation

<78.0-r0
  • H
Double Free

<74.0.1-r0
  • M
Origin Validation Error

<79.0-r0
  • H
Out-of-Bounds

<78.0-r0
  • M
Information Exposure

<79.0-r0
  • H
Use After Free

<79.0-r0
  • M
Information Exposure

<77.0-r0
  • C
Out-of-Bounds

<76.0-r0
  • H
CVE-2020-12409

<77.0-r0
  • C
Buffer Overflow

<76.0-r0
  • M
Use After Free

<77.0-r0
  • H
Race Condition

<76.0-r0
  • H
Uncontrolled Search Path Element

<78.0-r0
  • H
Out-of-bounds Write

<70.0-r0
  • M
Out-of-bounds Read

<78.0-r0
  • M
Information Exposure

<76.0-r0
  • H
Improper Input Validation

<76.0-r0
  • H
Use After Free

<74.0-r0
  • L
Improper Input Validation

<76.0-r0
  • C
Out-of-Bounds

<75.0-r0
  • M
Authentication Bypass

<74.0-r0
  • M
Authentication Bypass

<74.0-r0
  • M
Out-of-bounds Read

<74.0-r0
  • M
Cross-site Scripting (XSS)

<70.0-r0
  • C
Improper Input Validation

<76.0-r0
  • M
Improper Authentication

<71.0.1-r0
  • H
Information Exposure

<74.0-r0
  • L
Session Fixation

<75.0-r0
  • H
Out-of-bounds Write

<75.0-r0
  • H
Use After Free

<74.0.1-r0
  • M
Open Redirect

<103.0-r0
  • M
CVE-2022-36317

<103.0-r0
  • H
Out-of-bounds Read

<74.0-r0
  • C
Improper Privilege Management

<75.0-r0
  • H
Out-of-bounds Write

<71.0.1-r0
  • H
Access of Resource Using Incompatible Type ('Type Confusion')

<71.0.1-r0
  • H
Buffer Overflow

<71.0.1-r0
  • H
Out-of-bounds Write

<103.0-r0
  • M
Improper Input Validation

<71.0.1-r0
  • C
Improper Authentication

<68.0.2-r0
  • H
Use After Free

<74.0-r0
  • M
Cross-site Scripting (XSS)

<71.0.1-r0
  • M
Cross-site Scripting (XSS)

<70.0-r0
  • M
Race Condition

<70.0-r0
  • H
Buffer Overflow

<70.0-r0
  • H
Arbitrary Code Injection

<74.0-r0
  • C
Out-of-Bounds

<74.0-r0
  • C
Out-of-Bounds

<74.0-r0
  • H
Use After Free

<70.0-r0
  • H
Out-of-bounds Read

<70.0-r0
  • M
CVE-2023-5723

<119.0-r0
  • M
CVE-2023-5725

<119.0-r0
  • M
Uncontrolled Search Path Element

<103.0-r0
  • M
Improper Input Validation

<70.0-r0
  • H
Integer Overflow or Wraparound

<102.0-r0
  • H
Out-of-bounds Write

<70.0-r0
  • H
Use After Free

<70.0-r0
  • M
CVE-2022-34479

<102.0-r0
  • H
CVE-2023-5724

<119.0-r0
  • H
Access of Uninitialized Pointer

<102.0-r0
  • M
Information Exposure

<119.0-r0
  • M
Incorrect Default Permissions

<70.0-r0
  • C
Out-of-bounds Write

<119.0-r0
  • M
Origin Validation Error

<70.0-r0
  • M
CVE-2023-5727

<119.0-r0
  • C
CVE-2022-31736

<101.0-r0
  • C
Out-of-bounds Write

<119.0-r0
  • M
CVE-2023-5726

<119.0-r0
  • M
Improper Restriction of Rendered UI Layers or Frames

<119.0-r0
  • H
Out-of-bounds Write

<100.0-r0
  • M
CVE-2022-29915

<100.0-r0
  • M
CVE-2023-5729

<119.0-r0
  • H
CVE-2023-5728

<119.0-r0
  • C
Out-of-bounds Write

<100.0-r0
  • M
CVE-2022-36315

<103.0-r0
  • M
Race Condition

<103.0-r0
  • M
Open Redirect

<102.0-r0
  • C
Out-of-bounds Write

<103.0-r0
  • H
CVE-2022-36319

<103.0-r0
  • H
CVE-2022-34468

<102.0-r0
  • M
Cross-site Scripting (XSS)

<102.0-r0
  • M
CVE-2022-34471

<102.0-r0
  • H
Use of Uninitialized Resource

<101.0-r0
  • H
Use After Free

<102.0-r0
  • H
Use After Free

<101.0-r0
  • M
CVE-2022-34478

<102.0-r0
  • H
CVE-2022-34482

<102.0-r0
  • H
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

<102.0-r0
  • H
CVE-2022-34477

<102.0-r0
  • H
CVE-2022-34483

<102.0-r0
  • C
Use After Free

<102.0-r0
  • M
Cross-site Scripting (XSS)

<102.0-r0
  • H
CVE-2022-31740

<101.0-r0
  • M
CVE-2022-34472

<102.0-r0
  • C
CVE-2022-34476

<102.0-r0
  • M
Cross-site Scripting (XSS)

<101.0-r0
  • H
Improper Certificate Validation

<102.0-r0
  • C
Out-of-bounds Write

<102.0-r0
  • M
CVE-2022-31742

<101.0-r0
  • M
Authentication Bypass

<101.0-r0
  • C
Out-of-bounds Write

<101.0-r0
  • M
Improper Validation of Array Index

<101.0-r0
  • C
Out-of-bounds Read

<101.0-r0
  • M
Cross-site Scripting (XSS)

<101.0-r0
  • H
CVE-2022-31739

<101.0-r0
  • M
CVE-2022-29914

<100.0-r0
  • M
CVE-2022-29916

<100.0-r0
  • H
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

<100.0.2-r0
  • H
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

<100.0.2-r0
  • C
CVE-2022-31748

<101.0-r0
  • M
Improper Restriction of Rendered UI Layers or Frames

<100.0-r0
  • H
Incorrect Default Permissions

<100.0-r0
  • M
Open Redirect

<100.0-r0
  • M
Open Redirect

<100.0-r0