Mozilla
Page 11 of 38 — Mozilla CVEs from a corpus of 3730, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-3033 | High | 8.1 | 2022-12-22 | If a Thunderbird user replied to a crafted HTML email containing a <code>meta</code> tag, with the <code>meta</code> tag having the <code>http-equiv="refresh"<… |
CVE-2022-3032 | Medium | 6.5 | 2022-12-22 | When receiving an HTML email that contained an <code>iframe</code> element, which used a <code>srcdoc</code> attribute to define the inner HTML document, remot… |
CVE-2022-38478 | High | 8.8 | 2022-12-22 | Members the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103, Firefox ESR 102.1, and Firefox ESR 91.12. Some of these bugs showed eviden… |
CVE-2022-38477 | High | 8.8 | 2022-12-22 | Mozilla developer Nika Layzell and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103 and Firefox ESR 102.1. Some of these bugs showed… |
CVE-2022-38476 | High | 7.5 | 2022-12-22 | A data race could occur in the <code>PK11_ChangePW</code> function, potentially leading to a use-after-free vulnerability. In Firefox, this lock protected the… |
CVE-2022-38475 | Medium | 6.5 | 2022-12-22 | An attacker could have written a value to the first element in a zero-length JavaScript array. Although the array was zero-length, the value was not written to… |
CVE-2022-38474 | Medium | 4.3 | 2022-12-22 | A website that had permission to access the microphone could record audio without the audio notification being shown. This bug does not allow the attacker to b… |
CVE-2022-38473 | High | 8.8 | 2022-12-22 | A cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as microphone or camera access). This vulnerability affe… |
CVE-2022-38472 | Medium | 6.5 | 2022-12-22 | An attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which was displayed in the address bar. This cou… |
CVE-2022-36320 | Critical | 9.8 | 2022-12-22 | Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 102. Some of these bugs showed evidence of memory corruption and… |
CVE-2022-36319 | High | 7.5 | 2022-12-22 | When combining CSS properties for overflow and transform, the mouse cursor could interact with different coordinates than displayed. This vulnerability affects… |
CVE-2022-36318 | Medium | 5.3 | 2022-12-22 | When visiting directory listings for `chrome://` URLs as source text, some parameters were reflected. This vulnerability affects Firefox ESR < 102.1, Firefox E… |
CVE-2022-36317 | Medium | 6.5 | 2022-12-22 | When visiting a website with an overly long URL, the user interface would start to hang. Due to session restore, this could lead to a permanent Denial of Servi… |
CVE-2022-36316 | Medium | 6.1 | 2022-12-22 | When using the Performance API, an attacker was able to notice subtle differences between PerformanceEntries and thus learn whether the target URL had been sub… |
CVE-2022-36315 | Medium | 4.3 | 2022-12-22 | When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of previously cached entries with incorrect, d… |
CVE-2022-36314 | Medium | 5.5 | 2022-12-22 | When opening a Windows shortcut from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requests from the opera… |
CVE-2022-34485 | Critical | 9.8 | 2022-12-22 | Mozilla developers Bryce Seager van Dyk and the Mozilla Fuzzing Team reported potential vulnerabilities present in Firefox 101. Some of these bugs showed evide… |
CVE-2022-34484 | High | 8.8 | 2022-12-22 | The Mozilla Fuzzing Team reported potential vulnerabilities present in Thunderbird 91.10. Some of these bugs showed evidence of memory corruption and we presum… |
CVE-2022-34483 | High | 8.8 | 2022-12-22 | An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable ex… |
CVE-2022-34482 | High | 8.8 | 2022-12-22 | An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable ex… |
CVE-2022-34481 | High | 8.8 | 2022-12-22 | In the <code>nsTArray_Impl::ReplaceElementsAt()</code> function, an integer overflow could have occurred when the number of elements to replace was too large f… |
CVE-2022-34480 | High | 8.8 | 2022-12-22 | Within the <code>lg_init()</code> function, if several allocations succeed but then one fails, an uninitialized pointer would have been freed despite never bei… |
CVE-2022-34479 | Medium | 6.5 | 2022-12-22 | A malicious website that could create a popup could have resized the popup to overlay the address bar with its own content, resulting in potential user confusi… |
CVE-2022-34478 | Medium | 6.5 | 2022-12-22 | The <code>ms-msdt</code>, <code>search</code>, and <code>search-ms</code> protocols deliver content to Microsoft applications, bypassing the browser, when a us… |
CVE-2022-34477 | High | 7.5 | 2022-12-22 | The MediaError message property should be consistent to avoid leaking information about cross-origin resources; however for a same-site cross-origin resource… |
CVE-2022-34476 | Critical | 9.8 | 2022-12-22 | ASN.1 parsing of an indefinite SEQUENCE inside an indefinite GROUP could have resulted in the parser accepting malformed ASN.1. This vulnerability affects Fire… |
CVE-2022-34475 | Medium | 6.1 | 2022-12-22 | SVG <code><use></code> tags that referenced a same-origin document could have resulted in script execution if attacker input was sanitized via the HTML S… |
CVE-2022-34474 | Medium | 6.1 | 2022-12-22 | Even when an iframe was sandboxed with <code>allow-top-navigation-by-user-activation</code>, if it received a redirect header to an external protocol the brows… |
CVE-2022-34473 | Medium | 6.1 | 2022-12-22 | The HTML Sanitizer should have sanitized the <code>href</code> attribute of SVG <code><use></code> tags; however it incorrectly did not sanitize <code>xl… |
CVE-2022-34472 | Medium | 4.3 | 2022-12-22 | If there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have been blocked, resulting in incorrect error pages being… |
CVE-2022-34471 | Medium | 6.5 | 2022-12-22 | When downloading an update for an addon, the downloaded addon update's version was not verified to match the version selected from the manifest. If the manifes… |
CVE-2022-34470 | Critical | 9.8 | 2022-12-22 | Session history navigations may have led to a use-after-free and potentially exploitable crash. This vulnerability affects Firefox < 102, Firefox ESR < 91.11… |
CVE-2022-34469 | High | 8.1 | 2022-12-22 | When a TLS Certificate error occurs on a domain protected by the HSTS header, the browser should not allow the user to bypass the certificate error. On Firefox… |
CVE-2022-34468 | High | 8.8 | 2022-12-22 | An iframe that was not permitted to run scripts could do so if the user clicked on a <code>javascript:</code> link. This vulnerability affects Firefox < 102, F… |
CVE-2022-31748 | Critical | 9.8 | 2022-12-22 | Mozilla developers Gabriele Svelto, Timothy Nikkel, Randell Jesup, Jon Coppeard, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 10… |
CVE-2022-31747 | Critical | 9.8 | 2022-12-22 | Mozilla developers Andrew McCreight, Nicolas B. Pierron, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 100 and Firefox ESR 91.9… |
CVE-2022-31746 | Medium | 6.5 | 2022-12-22 | Internal URLs are protected by a secret UUID key, which could have been leaked to web page through the Referrer header. This vulnerability affects Firefox for… |
CVE-2022-31745 | Medium | 4.3 | 2022-12-22 | If array shift operations are not used, the Garbage Collector may have become confused about valid objects. This vulnerability affects Firefox < 101. |
CVE-2022-31744 | Medium | 6.5 | 2022-12-22 | An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so bypass a page's Content Security Policy… |
CVE-2022-31743 | Medium | 6.5 | 2022-12-22 | Firefox's HTML parser did not correctly interpret HTML comment tags, resulting in an incongruity with other browsers. This could have been used to escape HTML… |
CVE-2022-31742 | Medium | 6.5 | 2022-12-22 | An attacker could have exploited a timing attack by sending a large number of allowCredential entries and detecting the difference between invalid key handles… |
CVE-2022-31741 | High | 8.8 | 2022-12-22 | A crafted CMS message could have been processed incorrectly, leading to an invalid memory read, and potentially further memory corruption. This vulnerability a… |
CVE-2022-31740 | High | 8.8 | 2022-12-22 | On arm64, WASM code could have resulted in incorrect assembly generation leading to a register allocation problem, and a potentially exploitable crash. This vu… |
CVE-2022-31739 | High | 8.8 | 2022-12-22 | When downloading files on Windows, the % character was not escaped, which could have lead to a download incorrectly being saved to attacker-influenced paths th… |
CVE-2022-31738 | Medium | 6.5 | 2022-12-22 | When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user confusion or spoofin… |
CVE-2022-31737 | Critical | 9.8 | 2022-12-22 | A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially exploitable crash. This vulnerability aff… |
CVE-2022-31736 | Critical | 9.8 | 2022-12-22 | A malicious website could have learned the size of a cross-origin resource that supported Range requests. This vulnerability affects Thunderbird < 91.10, Firef… |
CVE-2022-2505 | High | 8.8 | 2022-12-22 | Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 102. Some of these bugs showed evidence of memory corruption and… |
CVE-2022-2226 | Medium | 6.5 | 2022-12-22 | An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, th… |
CVE-2022-2200 | High | 8.8 | 2022-12-22 | If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScript object, leading to privileged code e… |
CVE-2022-29918 | High | 8.8 | 2022-12-22 | Mozilla developers Gabriele Svelto, Randell Jesup and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 99. Some of these bugs showed evi… |
CVE-2022-29917 | Critical | 9.8 | 2022-12-22 | Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 99 and Firefox ESR… |
CVE-2022-29916 | Medium | 6.5 | 2022-12-22 | Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables. This could have been used to probe the bro… |
CVE-2022-29915 | Medium | 4.3 | 2022-12-22 | The Performance API did not properly hide the fact whether a request cross-origin resource has observed redirects. This vulnerability affects Firefox < 100. |
CVE-2022-29914 | Medium | 6.5 | 2022-12-22 | When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have enabled browser spoofing attacks. This v… |
CVE-2022-29913 | Medium | 6.5 | 2022-12-22 | The parent process would not properly check whether the Speech Synthesis feature is enabled, when receiving instructions from a child process. This vulnerabili… |
CVE-2022-29912 | Medium | 6.1 | 2022-12-22 | Requests initiated through reader mode did not properly omit cookies with a SameSite attribute. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91… |
CVE-2022-29911 | Medium | 6.1 | 2022-12-22 | An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could lead to script execution without <code>… |
CVE-2022-29910 | Medium | 6.1 | 2022-12-22 | When closed or sent to the background, Firefox for Android would not properly record and persist HSTS settings.<br>*Note: This issue only affected Firefox for… |
CVE-2022-29909 | High | 8.8 | 2022-12-22 | Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level origin, bypassing the existing prompt and wr… |
CVE-2022-28289 | High | 8.8 | 2022-12-22 | Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla Fuzzing Team reported memory safety bugs present in T… |
CVE-2022-28288 | High | 8.8 | 2022-12-22 | Mozilla developers and community members Randell Jesup, Sebastian Hengst, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 98. Some… |
CVE-2022-28287 | Medium | 6.5 | 2022-12-22 | In unusual circumstances, selecting text could cause text selection caching to behave incorrectly, leading to a crash. This vulnerability affects Firefox < 99. |
CVE-2022-28286 | Medium | 5.4 | 2022-12-22 | Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user confusion or spoofing attacks. This vulnera… |
CVE-2022-28285 | Medium | 6.5 | 2022-12-22 | When generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect AliasSet was used. In conjunction with another vulnerability this c… |
CVE-2022-28284 | High | 8.8 | 2022-12-22 | SVG's <code><use></code> element could have been used to load unexpected content that could have executed script in certain circumstances. While the spec… |
CVE-2022-28283 | Medium | 6.5 | 2022-12-22 | The sourceMapURL feature in devtools was missing security checks that would have allowed a webpage to attempt to include local files or other files that should… |
CVE-2022-28282 | Medium | 6.5 | 2022-12-22 | By using a link with <code>rel="localization"</code> a use-after-free could have been triggered by destroying an object during JavaScript execution and then re… |
CVE-2022-28281 | High | 8.8 | 2022-12-22 | If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent process, an out of bounds write would hav… |
CVE-2022-26486 | Critical | 9.6 | 2022-12-22 | An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abu… |
CVE-2022-26485 | High | 8.8 | 2022-12-22 | Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. Th… |
CVE-2022-26387 | High | 7.5 | 2022-12-22 | When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file c… |
CVE-2022-26386 | Medium | 6.5 | 2022-12-22 | Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in <code>/tmp</code>, but this behavior was changed to downl… |
CVE-2022-26385 | Medium | 6.5 | 2022-12-22 | In unusual circumstances, an individual thread may outlive the thread's manager during shutdown. This could have led to a use-after-free causing a potentially… |
CVE-2022-26384 | Critical | 9.6 | 2022-12-22 | If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scripts</code>, they were able to craft a l… |
CVE-2022-26383 | Medium | 4.3 | 2022-12-22 | When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification. This vulnerability affects Firefox < 98, Fir… |
CVE-2022-26382 | Medium | 4.3 | 2022-12-22 | While the text displayed in Autofill tooltips cannot be directly read by JavaScript, the text was rendered using page fonts. Side-channel attacks on the text b… |
CVE-2022-26381 | High | 8.8 | 2022-12-22 | An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a potentially exploitable crash. This vulnerability affects… |
CVE-2022-22764 | High | 8.8 | 2022-12-22 | Mozilla developers Paul Adenot and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 96 and Firefox ESR 91.5. Some of these bugs showed e… |
CVE-2022-22763 | High | 8.8 | 2022-12-22 | When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after where it should not be possible. This vulnerability a… |
CVE-2022-22762 | Medium | 4.3 | 2022-12-22 | Under certain circumstances, a JavaScript alert (or prompt) could have been shown while another website was displayed underneath it. This could have been abuse… |
CVE-2022-22761 | High | 8.8 | 2022-12-22 | Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors directive when it was used in the Web Ex… |
CVE-2022-22760 | Medium | 6.5 | 2022-12-22 | When importing resources using Web Workers, error messages would distinguish the difference between <code>application/javascript</code> responses and non-scrip… |
CVE-2022-22759 | Critical | 9.6 | 2022-12-22 | If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an element to the iframe's document that e.g. had a Java… |
CVE-2022-22758 | High | 8.8 | 2022-12-22 | When clicking on a tel: link, USSD codes, specified after a <code>\*</code> character, would be included in the phone number. On certain phones, or on certain… |
CVE-2022-22757 | Medium | 6.5 | 2022-12-22 | Remote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to connect back locally to the user's browser to… |
CVE-2022-22756 | High | 8.8 | 2022-12-22 | If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable script whic… |
CVE-2022-22755 | High | 8.8 | 2022-12-22 | By using XSL Transforms, a malicious webserver could have served a user an XSL document that would continue to execute JavaScript (within the bounds of the sam… |
CVE-2022-22754 | Medium | 6.5 | 2022-12-22 | If a user installed an extension of a particular type, the extension could have auto-updated itself and while doing so, bypass the prompt which grants the new… |
CVE-2022-22753 | High | 7.1 | 2022-12-22 | A Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant Users write access to an arbitrary directory. This c… |
CVE-2022-22752 | High | 8.8 | 2022-12-22 | Mozilla developers Christian Holler and Jason Kratzer reported memory safety bugs present in Firefox 95. Some of these bugs showed evidence of memory corruptio… |
CVE-2022-22751 | High | 8.8 | 2022-12-22 | Mozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele Svelto, Tyson Smith, Simon Giesecke, and Steve Fink reported memor… |
CVE-2022-22750 | Medium | 6.5 | 2022-12-22 | By generally accepting and passing resource handles across processes, a compromised content process might have confused higher privileged processes to interact… |
CVE-2022-22749 | Medium | 4.3 | 2022-12-22 | When scanning QR codes, Firefox for Android would have allowed navigation to some URLs that do not point to web content.<br>*This bug only affects Firefox for… |
CVE-2022-22748 | Medium | 6.5 | 2022-12-22 | Malicious websites could have confused Firefox into showing the wrong origin when asking to launch a program and handling an external URL protocol. This vulner… |
CVE-2022-22747 | Medium | 6.5 | 2022-12-22 | After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have lead to a crash. This crash is believed t… |
CVE-2022-22746 | Medium | 5.9 | 2022-12-22 | A race condition could have allowed bypassing the fullscreen notification which could have lead to a fullscreen window spoof being unnoticed.<br>*This bug only… |
CVE-2022-22745 | Medium | 6.5 | 2022-12-22 | Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations. This vulnerability affects Firefox ESR < 91.5, Firefo… |
CVE-2022-22744 | High | 8.8 | 2022-12-22 | The constructed curl command from the "Copy as curl" feature in DevTools was not properly escaped for PowerShell. This could have lead to command injection if… |
CVE-2022-22743 | Medium | 4.3 | 2022-12-22 | When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made the browser unable to leave fullscreen mod… |