Wladimir Palant

An information disclosure issue exists within the WebExtensions component, which allows for the unauthorized exposure of sensitive data.

The issue is related to insufficient restrictions in the controlled area of the system, which can be exploited by a remote attacker to gain unauthorized access to protected information.

The issue allows navigation to some URLs that do not point to web content when scanning QR codes. This bug only affects Firefox for Android, with other operating systems being unaffected.

The issue is related to the password autofill feature in Firefox for Android, which was enabled without user interaction on insecure websites. This allowed potential unauthorized access to protected information due to insufficient access control. The problem has been corrected to require user interaction before autofill functionality enters a user's password.

The issue is related to insufficient authentication of data in the "Private Browsing" mode of Mozilla Firefox. It allows a remote attacker to cause a denial of service. The problem specifically affects the address bar search suggestions in private browsing mode, which were reusing session data from normal mode. This issue only affects Firefox for Android, with other operating systems being unaffected.

The issue is related to the incorrect cleanup or release of resources, which can be exploited by an attacker to cause a denial of service. This can happen when a website opens too many popups, causing Firefox for Android to become unstable and hard to recover. The estimated number of potentially affected devices is not specified.

A malicious webpage could force a Firefox for Android user into executing attacker-controlled JavaScript in the context of another domain, resulting in a Universal Cross-Site Scripting issue. This issue only affects Firefox for Android, with other operating systems being unaffected. The vulnerability can be exploited by a remote attacker using a specially crafted link, allowing for a cross-site scripting (XSS) attack.

The issue is related to a lack of escaping, allowing HTML injection when a webpage is viewed in Reader View. Although a Content Security Policy prevents direct code execution, HTML injection is still possible. This issue only affects Firefox for Android, with other operating systems being unaffected.

The issue is related to an Improper Input Validation vulnerability in the Safepay browser component, allowing an external, specially crafted web page to run remote commands inside the Safepay Utility process. This vulnerability can be exploited to achieve remote code execution (RCE) from any website. The vulnerability is not the first instance of a security flaw in antivirus software, as similar issues have been found in other antivirus products in the past.

The web protection component of the affected Kaspersky products contains an issue that allows a remote attacker to disable various anti-virus protection features, potentially leading to a denial of service (DoS) or bypass of security measures. This is due to insufficient input validation.

The web protection component of the affected Kaspersky products contains an issue due to insufficient input validation, allowing a remote attacker to disable security features such as private browsing and anti-banner protection.

The web protection component of the affected Kaspersky products was vulnerable to remote disclosure of various information about the user's system, including Windows version, product version, and host unique ID. This issue is related to the lack of protection for service data, which could allow a remote attacker to disclose protected information.

The issue is related to Content Security Policy (CSP) directives that use hash-based sources. If such a directive is defined with an empty string as input, it allows the execution of any javascript: URIs, potentially bypassing CSP permissions and enabling malicious JavaScript content to run. This could allow a remote attacker to execute arbitrary code.

The issue is related to information disclosure in Kaspersky antivirus products. It could potentially disclose a unique Product ID by forcing the victim to visit a specially crafted webpage, such as via clicking a phishing link. This could allow a remote attacker to reveal protected information using a specially formed web page. The flaw may have allowed online trackers to identify users without using browser cookies.

The issue is related to errors in code generation management in the PDF Viewer component of Firefox ESR and Firefox browsers. It allows a remote attacker to execute arbitrary code using a specially crafted PDF file. The PDF viewer does not sufficiently sanitize PostScript calculator functions, enabling malicious JavaScript to be injected through a crafted PDF file. This JavaScript can then be run with the permissions of the PDF viewer by its worker.

The issue allows a malicious site to bypass same-origin protections for the PDF viewer, potentially intercepting messages meant for the viewer. This could enable the site to retrieve PDF files restricted to viewing by an authenticated user on a third-party website. The vulnerability is also described as being due to insufficient input validation in the Capture Handler component of Firefox ESR and Firefox browsers, which could allow a remote attacker to elevate their privileges.

The issue is related to the manipulation of the `baseURI` property of the theme element, allowing sites to bypass security checks on permissions to install lightweight themes. This could enable a malicious site to install a theme without user interaction, potentially containing offensive or embarrassing images. The vulnerability is associated with errors in processing permissions.

The issue is related to the web console and JavaScript debugger not properly sanitizing output, which can lead to displaying internal chrome pages as active hyperlinks. This could allow malicious sites to trick users into clicking on "javascript:" links, potentially leading to unauthorized access to protected information.

The issue allows HTML tags received from the Pocket server to be processed without sanitization, enabling any JavaScript code to be executed in the "about:pocket-saved" page. This gives the code access to Pocket's messaging API through HTML injection.

The Pocket toolbar button in Firefox does not verify the origin of incoming events, allowing content from other origins to fire events and inject content and commands into the Pocket context. This issue does not affect users with e10s enabled.