Mozilla » Firefox Esr : Security Vulnerabilities, CVEs, Published In 2019 (Information Leak)
When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
Max CVSS
7.5
EPSS Score
0.56%
Published
2019-07-23
Updated
2020-09-30
A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user. This allows extensions to run content scripts in local pages without permission warnings when a local file is opened. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.
Max CVSS
7.1
EPSS Score
0.06%
Published
2019-02-28
Updated
2019-03-01
2 vulnerabilities found