Mozilla
Page 14 of 38 — Mozilla CVEs from a corpus of 3730, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-26958 | Medium | 6.1 | 2020-12-09 | Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker. This could lead to a… |
CVE-2020-26957 | Medium | 6.5 | 2020-12-09 | OneCRL was non-functional in the new Firefox for Android due to a missing service initialization. This could result in a failure to enforce some certificate re… |
CVE-2020-26956 | Medium | 6.1 | 2020-12-09 | In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS. This vulnerability affects Firefox… |
CVE-2020-26955 | Medium | 6.5 | 2020-12-09 | When a user downloaded a file in Firefox for Android, if a cookie is set, it would have been re-sent during a subsequent file download operation on the same do… |
CVE-2020-26954 | Medium | 4.3 | 2020-12-09 | When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp mani… |
CVE-2020-26953 | Medium | 4.3 | 2020-12-09 | It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus making it possible to attempt a phishing attack or other… |
CVE-2020-26952 | High | 8.8 | 2020-12-09 | Incorrect bookkeeping of functions inlined during JIT compilation could have led to memory corruption and a potentially exploitable crash when handling out-of-… |
CVE-2020-26951 | Medium | 6.1 | 2020-12-09 | A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization. An attacker already capable of expl… |
CVE-2020-26950 | High | 8.8 | 2020-12-09 | In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condition. This vulnerab… |
CVE-2020-6829 | Medium | 5.3 | 2020-10-28 | When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which leaked partial information about the nonce used during… |
CVE-2020-15684 | Critical | 9.8 | 2020-10-22 | Mozilla developers reported memory safety bugs present in Firefox 81. Some of these bugs showed evidence of memory corruption and we presume that with enough e… |
CVE-2020-15683 | Critical | 9.8 | 2020-10-22 | Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of memory c… |
CVE-2020-15682 | Medium | 6.5 | 2020-10-22 | When a link to an external protocol was clicked, a prompt was presented that allowed the user to choose what application to open it in. An attacker could induc… |
CVE-2020-15681 | High | 7.5 | 2020-10-22 | When multiple WASM threads had a reference to a module, and were looking up exported functions, one WASM thread could have overwritten another's entry in a sha… |
CVE-2020-15680 | Medium | 5.3 | 2020-10-22 | If a valid external protocol handler was referenced in an image tag, the resulting broken image size could be distinguished from a broken image size of a non-e… |
CVE-2019-17007 | High | 7.5 | 2020-10-22 | In Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS to crash, resulting in a denial of service. |
CVE-2019-17006 | Critical | 9.8 | 2020-10-22 | In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library… |
CVE-2018-18508 | Medium | 6.5 | 2020-10-22 | In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resulting in a Denial of… |
CVE-2020-25648 | High | 7.5 | 2020-10-20 | A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing a… |
CVE-2020-15646 | Medium | 5.9 | 2020-10-08 | If an attacker intercepts Thunderbird's initial attempt to perform automatic account setup using the Microsoft Exchange autodiscovery mechanism, and the attack… |
CVE-2020-12401 | Medium | 4.7 | 2020-10-08 | During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time… |
CVE-2020-12400 | Medium | 4.7 | 2020-10-08 | When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side chan… |
CVE-2020-15678 | High | 8.8 | 2020-10-01 | When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free. This occurs because the… |
CVE-2020-15677 | Medium | 6.1 | 2020-10-01 | By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original s… |
CVE-2020-15676 | Medium | 6.1 | 2020-10-01 | Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attack… |
CVE-2020-15675 | High | 8.8 | 2020-10-01 | When processing surfaces, the lifetime may outlive a persistent buffer leading to memory corruption and a potentially exploitable crash. This vulnerability aff… |
CVE-2020-15674 | High | 8.8 | 2020-10-01 | Mozilla developers reported memory safety bugs present in Firefox 80. Some of these bugs showed evidence of memory corruption and we presume that with enough e… |
CVE-2020-15673 | High | 8.8 | 2020-10-01 | Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. Some of these bugs showed evidence of memory corruption and we presu… |
CVE-2020-15671 | Low | 3.1 | 2020-10-01 | When typing in a password under certain conditions, a race may have occured where the InputContext was not being correctly set for the input field, resulting i… |
CVE-2020-15670 | High | 8.8 | 2020-10-01 | Mozilla developers reported memory safety bugs present in Firefox for Android 79. Some of these bugs showed evidence of memory corruption and we presume that w… |
CVE-2020-15669 | High | 8.8 | 2020-10-01 | When aborting an operation, such as a fetch, an abort signal may be deleted while alerting the objects to be notified. This results in a use-after-free and we… |
CVE-2020-15668 | Medium | 4.3 | 2020-10-01 | A lock was missing when accessing a data structure and importing certificate information into the trust database. This vulnerability affects Firefox < 80 and F… |
CVE-2020-15667 | High | 8.8 | 2020-10-01 | When processing a MAR update file, after the signature has been validated, an invalid name length could result in a heap overflow, leading to memory corruption… |
CVE-2020-15666 | Medium | 6.5 | 2020-10-01 | When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500, 412, 403, etc.) was disclosed via the MediaError Message… |
CVE-2020-15665 | Medium | 4.3 | 2020-10-01 | Firefox did not reset the address bar after the beforeunload dialog was shown if the user chose to remain on the page. This could have resulted in an incorrect… |
CVE-2020-15664 | Medium | 6.5 | 2020-10-01 | By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would… |
CVE-2020-15663 | High | 8.8 | 2020-10-01 | If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the install location with system privilege… |
CVE-2020-15662 | Medium | 6.5 | 2020-08-10 | A rogue webpage could override the injected WKUserScript used by the download feature, this exploit could result in the user downloading an unintended file. Th… |
CVE-2020-15661 | Medium | 6.5 | 2020-08-10 | A rogue webpage could override the injected WKUserScript used by the logins autofill, this exploit could result in leaking a password for the current domain. T… |
CVE-2020-15659 | High | 8.8 | 2020-08-10 | Mozilla developers and community members reported memory safety bugs present in Firefox 78 and Firefox ESR 78.0. Some of these bugs showed evidence of memory c… |
CVE-2020-15658 | Medium | 6.5 | 2020-08-10 | The code for downloading files did not properly take care of special characters, which led to an attacker being able to cut off the file ending at an earlier p… |
CVE-2020-15657 | High | 7.8 | 2020-08-10 | Firefox could be made to load attacker-supplied DLL files from the installation directory. This required an attacker that is already capable of placing files i… |
CVE-2020-15656 | High | 8.8 | 2020-08-10 | JIT optimizations involving the Javascript arguments object could confuse later optimizations. This risk was already mitigated by various precautions in the co… |
CVE-2020-15655 | Medium | 6.5 | 2020-08-10 | A redirected HTTP request which is observed or modified through a web extension could bypass existing CORS checks, leading to potential disclosure of cross-ori… |
CVE-2020-15654 | Medium | 6.5 | 2020-08-10 | When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interface, when they are… |
CVE-2020-15653 | Medium | 6.5 | 2020-08-10 | An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links. This could have led to security issues for websites relying o… |
CVE-2020-15652 | Medium | 6.5 | 2020-08-10 | By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect. This applied only to content… |
CVE-2020-15651 | Medium | 4.3 | 2020-08-10 | A unicode RTL order character in the downloaded file name can be used to change the file's name during the download UI flow to change the file extension. This… |
CVE-2020-15650 | Medium | 5.5 | 2020-08-10 | Given an installed malicious file picker application, an attacker was able to overwrite local files and thus overwrite Firefox settings (but not access the pre… |
CVE-2020-15649 | Medium | 5.5 | 2020-08-10 | Given an installed malicious file picker application, an attacker was able to steal and upload local files of their choosing, regardless of the actually files… |
CVE-2020-15648 | Medium | 6.5 | 2020-08-10 | Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-Options header. This vulnerability affec… |
CVE-2020-15647 | High | 7.4 | 2020-08-10 | A Content Provider in Firefox for Android allowed local files accessible by the browser to be read by a remote webpage, leading to sensitive data disclosure, i… |
CVE-2020-12426 | High | 8.8 | 2020-07-09 | Mozilla developers and community members reported memory safety bugs present in Firefox 77. Some of these bugs showed evidence of memory corruption and we pres… |
CVE-2020-12425 | Medium | 6.5 | 2020-07-09 | Due to confusion processing a hyphen character in Date.parse(), a one-byte out of bounds read could have occurred, leading to potential information disclosure… |
CVE-2020-12423 | High | 7.8 | 2020-07-09 | When the Windows DLL "webauthn.dll" was missing from the Operating System, and a malicious one was placed in a folder in the user's %PATH%, Firefox may have lo… |
CVE-2020-12422 | High | 8.8 | 2020-07-09 | In non-standard configurations, a JPEG image created by JavaScript could have caused an internal variable to overflow, resulting in an out of bounds write, mem… |
CVE-2020-12421 | Medium | 6.5 | 2020-07-09 | When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by an administrator.)… |
CVE-2020-12420 | High | 8.8 | 2020-07-09 | When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to memory corruption and a potentially explo… |
CVE-2020-12419 | High | 8.8 | 2020-07-09 | When processing callbacks that occurred during window flushing in the parent process, the associated window may die; causing a use-after-free condition. This c… |
CVE-2020-12418 | Medium | 6.5 | 2020-07-09 | Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript. This vulnerability affec… |
CVE-2020-12417 | High | 8.8 | 2020-07-09 | Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memory corruption and a potentially exploitab… |
CVE-2020-12416 | High | 8.8 | 2020-07-09 | A VideoStreamEncoder may have been freed in a race condition with VideoBroadcaster::AddOrUpdateSink, resulting in a use-after-free, memory corruption, and a po… |
CVE-2020-12415 | Medium | 6.5 | 2020-07-09 | When "%2F" was present in a manifest URL, Firefox's AppCache behavior may have become confused and allowed a manifest to be served from a subdirectory. This co… |
CVE-2020-12414 | Medium | 6.5 | 2020-07-09 | IndexedDB should be cleared when leaving private browsing mode and it is not, the API for WKWebViewConfiguration was being used incorrectly and requires the pr… |
CVE-2020-12412 | Medium | 4.3 | 2020-07-09 | By navigating a tab using the history API, an attacker could cause the address bar to display the incorrect domain (with the https:// scheme, a blocked port nu… |
CVE-2020-12411 | High | 8.8 | 2020-07-09 | Mozilla developers reported memory safety bugs present in Firefox 76. Some of these bugs showed evidence of memory corruption and we presume that with enough e… |
CVE-2020-12410 | High | 8.8 | 2020-07-09 | Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8. Some of these bugs showed evidence of memory corruption and we presu… |
CVE-2020-12409 | High | 8.8 | 2020-07-09 | When using certain blank characters in a URL, they where incorrectly rendered as spaces instead of an encoded URL. This vulnerability affects Firefox < 77. |
CVE-2020-12408 | Medium | 6.5 | 2020-07-09 | When browsing a document hosted on an IP address, an attacker could insert certain characters to flip domain and path information in the address bar. This vuln… |
CVE-2020-12407 | Medium | 6.5 | 2020-07-09 | Mozilla Developer Nicolas Silva found that when using WebRender, Firefox would under certain conditions leak arbitrary GPU memory to the visible screen. The le… |
CVE-2020-12406 | High | 8.8 | 2020-07-09 | Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting in a crash. We presume that with enough effort that it… |
CVE-2020-12405 | Medium | 5.3 | 2020-07-09 | When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash. This vulnerability affects… |
CVE-2020-12404 | Medium | 4.3 | 2020-07-09 | For native-to-JS bridging the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token could leak when… |
CVE-2020-12402 | Medium | 4.4 | 2020-07-09 | During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow… |
CVE-2020-12399 | Medium | 4.4 | 2020-07-09 | NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. This vulnerability affects Thund… |
CVE-2020-12398 | High | 7.5 | 2020-07-09 | If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response, then Thunderbird will continue with an unencrypted co… |
CVE-2020-12424 | Medium | 6.5 | 2020-07-09 | When constructing a permission prompt for WebRTC, a URI was supplied from the content process. This URI was untrusted, and could have been the URI of an origin… |
CVE-2018-12371 | High | 8.8 | 2020-07-09 | An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM. This results in the… |
CVE-2020-13790 | High | 8.1 | 2020-06-03 | libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file. |
CVE-2020-6831 | Critical | 9.8 | 2020-05-26 | A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to memory corruption and a potentially exploitable crash… |
CVE-2020-6830 | High | 7.5 | 2020-05-26 | For native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token was being used… |
CVE-2020-12392 | Medium | 5.5 | 2020-05-26 | The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website. If a user… |
CVE-2020-12391 | High | 7.5 | 2020-05-26 | Documents formed using data: URLs in an OBJECT element failed to inherit the CSP of the creating context. This allowed the execution of scripts that should hav… |
CVE-2020-12390 | Critical | 9.8 | 2020-05-26 | Incorrect origin serialization of URLs with IPv6 addresses could lead to incorrect security checks. This vulnerability affects Firefox < 76. |
CVE-2020-12389 | Critical | 10.0 | 2020-05-26 | The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Wi… |
CVE-2020-12388 | Critical | 10.0 | 2020-05-26 | The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Wi… |
CVE-2020-12387 | High | 8.1 | 2020-05-26 | A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This resulted in a potentially exploitable crash. This vulner… |
CVE-2020-12396 | Critical | 9.8 | 2020-05-26 | Mozilla developers and community members reported memory safety bugs present in Firefox 75. Some of these bugs showed evidence of memory corruption and we pres… |
CVE-2020-12395 | Critical | 9.8 | 2020-05-26 | Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR 68.7. Some of these bugs showed evidence of memory c… |
CVE-2020-12394 | Low | 3.3 | 2020-05-26 | A logic flaw in our location bar implementation could have allowed a local attacker to spoof the current location by selecting a different origin and removing… |
CVE-2020-12393 | High | 7.8 | 2020-05-26 | The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user use… |
CVE-2020-12397 | Medium | 4.3 | 2020-05-22 | By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird displays. This vulnerab… |
CVE-2020-6828 | High | 7.5 | 2020-04-24 | A malicious Android application could craft an Intent that would have been processed by Firefox for Android and potentially result in a file overwrite in the u… |
CVE-2020-6827 | Medium | 4.7 | 2020-04-24 | When following a link that opened an intent://-schemed URL, causing a custom tab to be opened, Firefox for Android could be tricked into displaying the incorre… |
CVE-2020-6826 | Critical | 9.8 | 2020-04-24 | Mozilla developers Tyson Smith, Bob Clary, and Alexandru Michis reported memory safety bugs present in Firefox 74. Some of these bugs showed evidence of memory… |
CVE-2020-6825 | Critical | 9.8 | 2020-04-24 | Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 74 and Firefox ESR 68.6. Some of these… |
CVE-2020-6824 | Low | 2.8 | 2020-04-24 | Initially, a user opens a Private Browsing Window and generates a password for a site, then closes the Private Browsing Window but leaves Firefox open. Subsequ… |
CVE-2020-6823 | Critical | 9.8 | 2020-04-24 | A malicious extension could have called <code>browser.identity.launchWebAuthFlow</code>, controlling the redirect_uri, and through the Promise returned, obtain… |
CVE-2020-6822 | High | 8.8 | 2020-04-24 | On 32-bit builds, an out of bounds write could have occurred when processing an image larger than 4 GB in <code>GMPDecodeData</code>. It is possible that with… |
CVE-2020-6821 | High | 7.5 | 2020-04-24 | When reading from areas partially or fully outside the source resource with WebGL's <code>copyTexSubImage</code> method, the specification requires the returne… |