Nixpkgs security tracker
9.8 CRITICAL
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): High (H)
- Integrity (I): High (H)
- Availability (A): High (H)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): High (H)
- Modified Availability (MA): High (H)
Activity log
- Created suggestion
Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2
Memory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 149.0.2, Firefox ESR < 115.34.1, Firefox ESR < 140.9.1, Thunderbird < 149.0.2, and Thunderbird < 140.9.1.
References
Affected products
- <149.0.2
- <140.9.1
- <115.34.1
- <149.0.2
- <140.9.1
Matching in nixpkgs
pkgs.faust2firefox
The faust2firefox script, part of faust functional programming language for realtime audio signal processing
pkgs.firefox_decrypt
Tool to extract passwords from profiles of Mozilla Firefox and derivatives
pkgs.thunderbird-cli
Low-level CLI to manage Mozilla Thunderbird email from the shell
pkgs.thunderbird-mcp
MCP server for Thunderbird - enables AI assistants to access email, contacts, and calendars
pkgs.pkgsRocm.firefox
Web browser built from Firefox source tree
pkgs.firefox-unwrapped
Web browser built from Firefox source tree
pkgs.firefox-gnome-theme
GNOME theme for Firefox
pkgs.firefox-sync-client
Commandline-utility to list/view/edit/delete entries in a firefox-sync account
pkgs.pkgsRocm.firefoxpwa
Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)
pkgs.thunderbird-cli-mcp
MCP server that gives full access to your email through Mozilla Thunderbird
pkgs.firefox-devtools-mcp
Model Context Protocol server for Firefox DevTools automation
-
nixos-unstable -
- nixos-unstable-small 0.9.9
pkgs.firefoxpwa-unwrapped
Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)
pkgs.pkgsRocm.thunderbird
Full-featured e-mail client
pkgs.firefox-esr-unwrapped
Web browser built from Firefox source tree
-
nixos-unstable -
- nixos-unstable-small 153.3.0esr
-
nixos-26.05 -
- nixos-26.05-small 153.3.0esr
pkgs.pkgsRocm.firefox-beta
Web browser built from Firefox Beta Release source tree
pkgs.thunderbird-unwrapped
Full-featured e-mail client
pkgs.firefox-beta-unwrapped
Web browser built from Firefox Beta Release source tree
pkgs.thunderbird-cli-bridge
HTTP/WebSocket bridge daemon between thunderbird-cli (or any HTTP client) and the Thunderbird-cli WebExtension. Stateless proxy, localhost-only.
pkgs.pkgsRocm.firefox-mobile
Web browser built from Firefox source tree
pkgs.pkgsRocm.firefox-esr-153
Web browser built from Firefox source tree
-
nixos-unstable -
- nixos-unstable-small 153.3.0esr
pkgs.pkgsRocm.thunderbird-153
Full-featured e-mail client
-
nixos-unstable -
- nixos-unstable-small 153.2.0esr
pkgs.firefox-esr-140-unwrapped
Web browser built from Firefox source tree
-
nixos-unstable -
- nixos-unstable-small 140.16.0esr
-
nixos-26.05 -
- nixos-26.05-small 140.16.0esr
pkgs.firefox-esr-153-unwrapped
Web browser built from Firefox source tree
-
nixos-unstable -
- nixos-unstable-small 153.3.0esr
-
nixos-26.05 -
- nixos-26.05-small 153.3.0esr
pkgs.thunderbird-140-unwrapped
Full-featured e-mail client
-
nixos-unstable -
- nixos-unstable-small 140.15.0esr
-
nixos-26.05 -
- nixos-26.05-small 140.15.0esr
pkgs.thunderbird-153-unwrapped
Full-featured e-mail client
-
nixos-unstable -
- nixos-unstable-small 153.2.0esr
-
nixos-26.05 -
- nixos-26.05-small 153.2.0esr
pkgs.thunderbird-esr-unwrapped
Full-featured e-mail client
-
nixos-unstable -
- nixos-unstable-small 153.2.0esr
-
nixos-26.05 -
- nixos-26.05-small 153.2.0esr
pkgs.pkgsRocm.firefox-unwrapped
Web browser built from Firefox source tree
pkgs.pkgsRocm.firefox-devedition
Web browser built from Firefox Developer Edition source tree
pkgs.pkgsRocm.thunderbird-latest
Full-featured e-mail client
pkgs.firefox-devedition-unwrapped
Web browser built from Firefox Developer Edition source tree
pkgs.thunderbird-latest-unwrapped
Full-featured e-mail client
pkgs.pkgsRocm.firefoxpwa-unwrapped
Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)
-
nixos-unstable -
- nixos-unstable-small 2.19.0
pkgs.pkgsRocm.thunderbird-unwrapped
Full-featured e-mail client
pkgs.pkgsRocm.firefox-beta-unwrapped
Web browser built from Firefox Beta Release source tree
pkgs.thunderbirdPackages.thunderbird
Full-featured e-mail client
pkgs.gnomeExtensions.firefox-profiles
Easily launch Firefox with your favorite profile right from the indicator menu!
pkgs.gnomeExtensions.thunderbird-tray
Start Thunderbird headless when closing main Thunderbird
-
nixos-unstable -
- nixos-unstable-small 5
pkgs.pkgsRocm.firefox-esr-153-unwrapped
Web browser built from Firefox source tree
-
nixos-unstable -
- nixos-unstable-small 153.3.0esr
pkgs.pkgsRocm.thunderbird-153-unwrapped
Full-featured e-mail client
-
nixos-unstable -
- nixos-unstable-small 153.2.0esr
pkgs.roundcubePlugins.thunderbird_labels
None
pkgs.thunderbirdPackages.thunderbird-140
Full-featured e-mail client
-
nixos-unstable -
- nixos-unstable-small 140.15.0esr
-
nixos-26.05 -
- nixos-26.05-small 140.15.0esr
pkgs.thunderbirdPackages.thunderbird-153
Full-featured e-mail client
-
nixos-unstable -
- nixos-unstable-small 153.2.0esr
-
nixos-26.05 -
- nixos-26.05-small 153.2.0esr
pkgs.thunderbirdPackages.thunderbird-esr
Full-featured e-mail client
-
nixos-unstable -
- nixos-unstable-small 153.2.0esr
-
nixos-26.05 -
- nixos-26.05-small 153.2.0esr
pkgs.pkgsRocm.firefox-devedition-unwrapped
Web browser built from Firefox Developer Edition source tree
pkgs.pkgsRocm.thunderbird-latest-unwrapped
Full-featured e-mail client
pkgs.thunderbirdPackages.thunderbird-latest
Full-featured e-mail client
pkgs.pkgsRocm.thunderbirdPackages.thunderbird
Full-featured e-mail client
pkgs.gnomeExtensions.firefox-pip-always-on-top
Automatically sets Picture-in-Picture windows to always be on top and visible on all workspaces
pkgs.gnomeExtensions.pip-alwaysontop-for-firefox
Enable Picture-in-Picture(PIP) mode to always be on for Firefox in Gnome.
pkgs.pkgsRocm.thunderbirdPackages.thunderbird-153
Full-featured e-mail client
-
nixos-unstable -
- nixos-unstable-small 153.2.0esr
pkgs.pkgsRocm.thunderbirdPackages.thunderbird-latest
Full-featured e-mail client
pkgs.vscode-extensions.firefox-devtools.vscode-firefox-debug
Visual Studio Code extension for debugging web applications and browser extensions in Firefox
Package maintainers
-
@magnetophon Bart Brouns <bart@magnetophon.nl>
-
@pmahoney Patrick Mahoney <pat@polycrystal.org>
-
@jopejoe1 jopejoe1 <nixpkgs@missing.ninja>
-
@rhendric Ryan Hendrickson
-
@mweinelt Martin Weinelt <hexa@darmstadt.ccc.de>
-
@nekowinston winston <hey@winston.sh>
-
@ambroisie Bruno BELANYI <bruno.nixpkgs@belanyi.fr>
-
@booxter Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
-
@schnusch schnusch
-
@unode Renato Alves <alves.rjc@gmail.com>
-
@camillemndn Camille M. <camillemondon@free.fr>
-
@pasqui23 pasqui23 <p3dimaria@hotmail.it>
-
@honnip Jung seungwoo <me@honnip.page>
-
@lovesegfault Bernardo Meurer <meurerbernardo@gmail.com>
-
@vcunat Vladimír Čunát <v@cunat.cz>
-
@nbp Nicolas B. Pierron <nixos@nbp.name>
-
@drupol Pol Dellaiera <pol.dellaiera@protonmail.com>
-
@felschr Felix Schröter <dev@felschr.com>
-
@philiptaron Philip Taron <philip.taron@gmail.com>