MozillaFirefox-branding-SLE (SUSE:Linux Enterprise Module for Desktop Applications 15 SP2) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise Module for Desktop Applications 15 SP2 package MozillaFirefox-branding-SLE, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (43)

• CVE-2021-32810 — CVSS 9.8 (critical): crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust. In versions prior to 0.7.4 and…
• CVE-2021-29984 — CVSS 8.8 (high): Instruction reordering resulted in a sequence of instructions that would cause an object to be incorrectly considered during garbage…
• CVE-2021-29985 — CVSS 8.8 (high): A use-after-free vulnerability in media channels could have led to memory corruption and a potentially exploitable crash. This…
• CVE-2020-12420 — CVSS 8.8 (high): When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to memory corruption and…
• CVE-2021-29988 — CVSS 8.8 (high): Firefox incorrectly treated an inline list-item element as a block element, resulting in an out of bounds read or memory corruption, and a…
• CVE-2021-29989 — CVSS 8.8 (high): Mozilla developers reported memory safety bugs present in Firefox 90 and Firefox ESR 78.12. Some of these bugs showed evidence of memory…
• CVE-2021-29990 — CVSS 8.8 (high): Mozilla developers and community members reported memory safety bugs present in Firefox 90. Some of these bugs showed evidence of memory…
• CVE-2020-12426 — CVSS 8.8 (high): Mozilla developers and community members reported memory safety bugs present in Firefox 77. Some of these bugs showed evidence of memory…
• CVE-2020-6463 — CVSS 8.8 (high): Use after free in ANGLE in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially exploit heap corruption via a…
• CVE-2020-12419 — CVSS 8.8 (high): When processing callbacks that occurred during window flushing in the parent process, the associated window may die; causing a…
• CVE-2021-29980 — CVSS 8.8 (high): Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption and a potentially exploitable…
• CVE-2021-29981 — CVSS 8.8 (high): An issue present in lowering/register allocation could have led to obscure but deterministic register confusion failures in JITted code…
• CVE-2021-38501 — CVSS 8.8 (high): Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed evidence of memory…
• CVE-2020-12417 — CVSS 8.8 (high): Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memory corruption and a…
• CVE-2021-38495 — CVSS 8.8 (high): Mozilla developers reported memory safety bugs present in Thunderbird 78.13.0. Some of these bugs showed evidence of memory corruption and…
• CVE-2021-38496 — CVSS 8.8 (high): During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in memory corruption and a…
• CVE-2020-12422 — CVSS 8.8 (high): In non-standard configurations, a JPEG image created by JavaScript could have caused an internal variable to overflow, resulting in an out…
• CVE-2021-38500 — CVSS 8.8 (high): Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed evidence of memory…
• CVE-2020-15656 — CVSS 8.8 (high): JIT optimizations involving the Javascript arguments object could confuse later optimizations. This risk was already mitigated by various…
• CVE-2020-12416 — CVSS 8.8 (high): A VideoStreamEncoder may have been freed in a race condition with VideoBroadcaster::AddOrUpdateSink, resulting in a use-after-free, memory…
• CVE-2020-15659 — CVSS 8.8 (high): Mozilla developers and community members reported memory safety bugs present in Firefox 78 and Firefox ESR 78.0. Some of these bugs showed…
• CVE-2021-29991 — CVSS 8.1 (high): Firefox incorrectly accepted a newline in a HTTP/3 header, interpretting it as two separate headers. This allowed for a header splitting…
• CVE-2021-29986 — CVSS 8.1 (high): A suspected race condition when calling getaddrinfo led to memory corruption and a potentially exploitable crash. *Note: This issue only…
• CVE-2020-12423 — CVSS 7.8 (high): When the Windows DLL "webauthn.dll" was missing from the Operating System, and a malicious one was placed in a folder in the user's %PATH%…
• CVE-2020-15657 — CVSS 7.8 (high): Firefox could be made to load attacker-supplied DLL files from the installation directory. This required an attacker that is already…
• CVE-2021-38498 — CVSS 7.5 (high): During process shutdown, a document could have caused a use-after-free of a languages service object, leading to memory corruption and a…
• CVE-2021-29983 — CVSS 6.5 (medium): Firefox for Android could get stuck in fullscreen mode and not exit it even after normal interactions that should cause it to exit. *Note…
• CVE-2020-12415 — CVSS 6.5 (medium): When "%2F" was present in a manifest URL, Firefox's AppCache behavior may have become confused and allowed a manifest to be served from a…
• CVE-2020-12418 — CVSS 6.5 (medium): Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript. This…
• CVE-2020-12421 — CVSS 6.5 (medium): When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by…
• CVE-2020-12424 — CVSS 6.5 (medium): When constructing a permission prompt for WebRTC, a URI was supplied from the content process. This URI was untrusted, and could have been…
• CVE-2020-12425 — CVSS 6.5 (medium): Due to confusion processing a hyphen character in Date.parse(), a one-byte out of bounds read could have occurred, leading to potential…
• CVE-2020-15652 — CVSS 6.5 (medium): By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect. This…
• CVE-2020-15653 — CVSS 6.5 (medium): An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links. This could have led to security issues…
• CVE-2020-15654 — CVSS 6.5 (medium): When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user…
• CVE-2020-15655 — CVSS 6.5 (medium): A redirected HTTP request which is observed or modified through a web extension could bypass existing CORS checks, leading to potential…
• CVE-2020-15658 — CVSS 6.5 (medium): The code for downloading files did not properly take care of special characters, which led to an attacker being able to cut off the file…
• CVE-2020-6514 — CVSS 6.5 (medium): Inappropriate implementation in WebRTC in Google Chrome prior to 84.0.4147.89 allowed an attacker in a privileged network position to…
• CVE-2021-29982 — CVSS 6.5 (medium): Due to incorrect JIT optimization, we incorrectly interpreted data from the wrong type of object, resulting in the potential leak of a…
• CVE-2021-29987 — CVSS 6.5 (medium): After requesting multiple permissions, and closing the first permission panel, subsequent permission panels will be displayed in a…
• CVE-2021-38492 — CVSS 6.5 (medium): When delegating navigations to the operating system, Firefox would accept the `mk` scheme which might allow attackers to launch pages and…
• CVE-2021-38497 — CVSS 6.5 (medium): Through use of reportValidity() and window.open(), a plain-text validation message could have been overlaid on another origin, leading to…
• CVE-2020-12402 — CVSS 4.4 (medium): During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly…