Mozilla
Page 16 of 38 — Mozilla CVEs from a corpus of 3730, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-9814 | Critical | 9.8 | 2019-07-23 | Mozilla developers and community members reported memory safety bugs present in Firefox 66. Some of these bugs showed evidence of memory corruption and we pres… |
CVE-2019-9811 | High | 8.3 | 2019-07-23 | As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that… |
CVE-2019-9800 | Critical | 9.8 | 2019-07-23 | Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed e… |
CVE-2019-11730 | Medium | 6.5 | 2019-07-23 | A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same directory or sub-directo… |
CVE-2019-11729 | High | 7.5 | 2019-07-23 | Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This… |
CVE-2019-11728 | Medium | 4.7 | 2019-07-23 | The HTTP Alternative Services header, Alt-Svc, can be used by a malicious site to scan all TCP ports of any host that the accessible to a user when web content… |
CVE-2019-11727 | Medium | 5.3 | 2019-07-23 | A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only… |
CVE-2019-11725 | Medium | 6.5 | 2019-07-23 | When a user navigates to site marked as unsafe by the Safebrowsing API, warning messages are displayed and navigation is interrupted but resources from the sam… |
CVE-2019-11724 | Medium | 6.1 | 2019-07-23 | Application permissions give additional remote troubleshooting permission to the site input.mozilla.org, which has been retired and now redirects to another si… |
CVE-2019-11723 | High | 7.5 | 2019-07-23 | A vulnerability exists during the installation of add-ons where the initial fetch ignored the origin attributes of the browsing context. This could leak cookie… |
CVE-2019-11721 | Medium | 6.5 | 2019-07-23 | The unicode latin 'kra' character can be used to spoof a standard 'k' character in the addressbar. This allows for domain spoofing attacks as do not display as… |
CVE-2019-11720 | Medium | 6.1 | 2019-07-23 | Some unicode characters are incorrectly treated as whitespace during the parsing of web content instead of triggering parsing errors. This allows malicious cod… |
CVE-2019-11719 | High | 7.5 | 2019-07-23 | When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Servic… |
CVE-2019-11718 | Medium | 5.3 | 2019-07-23 | Activity Stream can display content from sent from the Snippet Service website. This content is written to innerHTML on the Activity Stream page without saniti… |
CVE-2019-11717 | Medium | 5.3 | 2019-07-23 | A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being used as a separator, allowing for possible… |
CVE-2019-11716 | High | 8.3 | 2019-07-23 | Until explicitly accessed by script, window.globalThis is not enumerable and, as a result, is not visible to code such as Object.getOwnPropertyNames(window). S… |
CVE-2019-11715 | Medium | 6.1 | 2019-07-23 | Due to an error while parsing page content, it is possible for properly sanitized user input to be misinterpreted and lead to XSS hazards on web sites in certa… |
CVE-2019-11714 | Critical | 9.8 | 2019-07-23 | Necko can access a child on the wrong thread during UDP connections, resulting in a potentially exploitable crash in some instances. This vulnerability affects… |
CVE-2019-11713 | Critical | 9.8 | 2019-07-23 | A use-after-free vulnerability can occur in HTTP/2 when a cached HTTP/2 stream is closed while still in use, resulting in a potentially exploitable crash. This… |
CVE-2019-11712 | High | 8.8 | 2019-07-23 | POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS requirements. This can allow an attacker to per… |
CVE-2019-11711 | High | 8.8 | 2019-07-23 | When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomains ever cooperative… |
CVE-2019-11710 | Critical | 9.8 | 2019-07-23 | Mozilla developers and community members reported memory safety bugs present in Firefox 67. Some of these bugs showed evidence of memory corruption and we pres… |
CVE-2019-11709 | Critical | 9.8 | 2019-07-23 | Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7. Some of these bugs showed evidence of memory c… |
CVE-2019-11708 | Critical | 10.0 | 2019-07-23 | Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process op… |
CVE-2019-11707 | High | 8.8 | 2019-07-23 | A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware… |
CVE-2019-11706 | High | 7.5 | 2019-07-23 | A flaw in Thunderbird's implementation of iCal causes a type confusion in icaltimezone_get_vtimezone_properties when processing certain email messages, resulti… |
CVE-2019-11705 | Critical | 9.8 | 2019-07-23 | A flaw in Thunderbird's implementation of iCal causes a stack buffer overflow in icalrecur_add_bydayrules when processing certain email messages, resulting in… |
CVE-2019-11704 | Critical | 9.8 | 2019-07-23 | A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in icalmemory_strdup_and_dequote when processing certain email messages, resulting… |
CVE-2019-11703 | Critical | 9.8 | 2019-07-23 | A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in parser_get_next_char when processing certain email messages, resulting in a pot… |
CVE-2019-11702 | Medium | 6.5 | 2019-07-23 | A hyperlink using protocols associated with Internet Explorer, such as IE.HTTP:, can be used to open local files at a known location with Internet Explorer if… |
CVE-2019-11701 | Medium | 6.1 | 2019-07-23 | The default webcal: protocol handler will load a web site vulnerable to cross-site scripting (XSS) attacks. This default was left in place as a legacy feature… |
CVE-2019-11700 | Medium | 6.5 | 2019-07-23 | A hyperlink using the res: protocol can be used to open local files at a known location in Internet Explorer if a user approves execution when prompted. *Note… |
CVE-2019-11699 | Medium | 6.5 | 2019-07-23 | A malicious page can briefly cause the wrong name to be highlighted as the domain name in the addressbar during page navigations. This could result in user con… |
CVE-2019-11698 | Medium | 5.3 | 2019-07-23 | If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web conten… |
CVE-2019-11697 | Medium | 6.5 | 2019-07-23 | If the ALT and "a" keys are pressed when users receive an extension installation prompt, the extension will be installed without the install prompt delay that… |
CVE-2019-11696 | High | 7.8 | 2019-07-23 | Files with the .JNLP extension used for "Java web start" applications are not treated as executable content for download prompts even though they can be execut… |
CVE-2019-11695 | Medium | 4.3 | 2019-07-23 | A custom cursor defined by scripting on a site can position itself over the addressbar to spoof the actual cursor when it should not be allowed outside of the… |
CVE-2019-11694 | High | 7.5 | 2019-07-23 | A vulnerability exists in the Windows sandbox where an uninitialized value in memory can be leaked to a renderer from a broker when making a call to access an… |
CVE-2019-11693 | Critical | 9.8 | 2019-07-23 | The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a… |
CVE-2019-11692 | Critical | 9.8 | 2019-07-23 | A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable… |
CVE-2019-11691 | Critical | 9.8 | 2019-07-23 | A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been fr… |
CVE-2018-12404 | Medium | 5.9 | 2019-05-02 | A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chos… |
CVE-2018-5123 | High | 8.8 | 2019-04-29 | A third party website can access information available to a user with access to a restricted bug entry using the image generation in report.cgi in all Bugzilla… |
CVE-2018-12384 | Medium | 5.9 | 2019-04-29 | When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full… |
CVE-2019-9813 | High | 8.8 | 2019-04-26 | Incorrect handling of __proto__ mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arbitrary memory read and write. This vulne… |
CVE-2019-9810 | High | 8.8 | 2019-04-26 | Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow. This vulnerabili… |
CVE-2019-9809 | High | 7.5 | 2019-04-26 | If the source for resources on a page is through an FTP connection, it is possible to trigger a series of modal alert messages for these resources through inva… |
CVE-2019-9808 | Medium | 5.3 | 2019-04-26 | If WebRTC permission is requested from documents with data: or blob: URLs, the permission notifications do not properly display the originating domain. The not… |
CVE-2019-9807 | Medium | 4.3 | 2019-04-26 | When arbitrary text is sent over an FTP connection and a page reload is initiated, it is possible to create a modal alert message with this text as the content… |
CVE-2019-9806 | High | 7.5 | 2019-04-26 | A vulnerability exists during authorization prompting for FTP transaction where successive modal prompts are displayed and cannot be immediately dismissed. Thi… |
CVE-2019-9805 | Critical | 9.8 | 2019-04-26 | A latent vulnerability exists in the Prio library where data may be read from uninitialized memory for some functions, leading to potential memory corruption… |
CVE-2019-9804 | Critical | 9.8 | 2019-04-26 | In Firefox Developer Tools it is possible that pasting the result of the 'Copy as cURL' command into a command shell on macOS will cause the execution of unint… |
CVE-2019-9803 | High | 7.4 | 2019-04-26 | The Upgrade-Insecure-Requests (UIR) specification states that if UIR is enabled through Content Security Policy (CSP), navigation to a same-origin URL must be… |
CVE-2019-9802 | High | 7.5 | 2019-04-26 | If a Sandbox content process is compromised, it can initiate an FTP download which will then use a child process to render the downloaded data. The downloaded… |
CVE-2019-9801 | Medium | 5.3 | 2019-04-26 | Firefox will accept any registered Program ID as an external protocol handler and offer to launch this local application when given a matching URL on Windows o… |
CVE-2019-9799 | High | 7.5 | 2019-04-26 | Insufficient bounds checking of data during inter-process communication might allow a compromised content process to be able to read memory from the parent pro… |
CVE-2019-9798 | High | 7.4 | 2019-04-26 | On Android systems, Firefox can load a library from APITRACE_LIB, which is writable by all users and applications. This could allow malicious third party appli… |
CVE-2019-9797 | Medium | 5.3 | 2019-04-26 | Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering… |
CVE-2019-9796 | Critical | 9.8 | 2019-04-26 | A use-after-free vulnerability can occur when the SMIL animation controller incorrectly registers with the refresh driver twice when only a single registration… |
CVE-2019-9795 | Critical | 9.8 | 2019-04-26 | A vulnerability where type-confusion in the IonMonkey just-in-time (JIT) compiler could potentially be used by malicious JavaScript to trigger a potentially ex… |
CVE-2019-9794 | Critical | 9.8 | 2019-04-26 | A vulnerability was discovered where specific command line arguments are not properly discarded during Firefox invocation as a shell handler for URLs. This cou… |
CVE-2019-9793 | Medium | 5.9 | 2019-04-26 | A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre mitigations have been disabled. This vulnera… |
CVE-2019-9792 | Critical | 9.8 | 2019-04-26 | The IonMonkey just-in-time (JIT) compiler can leak an internal JS_OPTIMIZED_OUT magic value to the running script during a bailout. This magic value can then b… |
CVE-2019-9791 | Critical | 9.8 | 2019-04-26 | The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects when compiled through the IonMonkey just… |
CVE-2019-9790 | Critical | 9.8 | 2019-04-26 | A use-after-free vulnerability can occur when a raw pointer to a DOM element on a page is obtained using JavaScript and the element is then removed while still… |
CVE-2019-9789 | Critical | 9.8 | 2019-04-26 | Mozilla developers and community members reported memory safety bugs present in Firefox 65. Some of these bugs showed evidence of memory corruption and we pres… |
CVE-2019-9788 | Critical | 9.8 | 2019-04-26 | Mozilla developers and community members reported memory safety bugs present in Firefox 65, Firefox ESR 60.5, and Thunderbird 60.5. Some of these bugs showed e… |
CVE-2018-5124 | Medium | 6.1 | 2019-04-26 | Unsanitized output in the browser UI leaves HTML tags in place and can result in arbitrary code execution in Firefox before version 58.0.1. |
CVE-2018-18513 | High | 7.5 | 2019-04-26 | A crash can occur when processing a crafted S/MIME message or an XPI package containing a crafted signature. This can be used as a denial-of-service (DOS) atta… |
CVE-2018-18512 | Critical | 9.8 | 2019-04-26 | A use-after-free vulnerability can occur while playing a sound notification in Thunderbird. The memory storing the sound data is immediately freed, although th… |
CVE-2018-18511 | Medium | 4.3 | 2019-04-26 | Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note: This only affects… |
CVE-2018-18510 | Medium | 6.5 | 2019-04-26 | The about:crashcontent and about:crashparent pages can be triggered by web content. These pages are used to crash the loaded page or the browser for test purpo… |
CVE-2018-18509 | Medium | 5.3 | 2019-04-26 | A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird as having a valid digital signature, even if the shown message… |
CVE-2018-5179 | High | 7.5 | 2019-04-26 | A service worker can send the activate event on itself periodically which allows it to run perpetually, allowing it to monitor activity by users. Affects all v… |
CVE-2017-7777 | High | 8.8 | 2019-04-15 | Use of uninitialized memory in Graphite2 library in Firefox before 54 in graphite2::GlyphCache::Loader::read_glyph function. |
CVE-2017-7776 | High | 8.1 | 2019-04-15 | Heap-based Buffer Overflow read in Graphite2 library in Firefox before 54 in graphite2::Silf::getClassGlyph. |
CVE-2017-7774 | Critical | 9.1 | 2019-04-15 | Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Silf::readGraphite function. |
CVE-2017-7773 | High | 8.8 | 2019-04-15 | Heap-based Buffer Overflow write in Graphite2 library in Firefox before 54 in lz4::decompress src/Decompressor. |
CVE-2017-7771 | High | 8.1 | 2019-04-15 | Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Pass::readPass function. |
CVE-2017-7772 | High | 8.8 | 2019-04-12 | Heap-based Buffer Overflow in Graphite2 library in Firefox before 54 in lz4::decompress function. |
CVE-2018-14498 | Medium | 6.5 | 2019-03-07 | get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read an… |
CVE-2018-18499 | Medium | 6.5 | 2019-02-28 | A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv="refresh" on a page to cause a redirection to anothe… |
CVE-2018-18498 | Critical | 9.8 | 2019-02-28 | A potential vulnerability leading to an integer overflow can occur during buffer size calculations for images when a raw value is used instead of the checked v… |
CVE-2018-18497 | Medium | 6.5 | 2019-02-28 | Limitations on the URIs allowed to WebExtensions by the browser.windows.create API can be bypassed when a pipe in the URL field is used within the extension to… |
CVE-2018-18496 | High | 8.8 | 2019-02-28 | When the RSS Feed preview about:feeds page is framed within another page, it can be used in concert with scripted content for a clickjacking attack that confus… |
CVE-2018-18495 | Medium | 6.5 | 2019-02-28 | WebExtension content scripts can be loaded into about: pages in some circumstances, in violation of the permissions granted to extensions. This could allow an… |
CVE-2018-18494 | Medium | 6.5 | 2019-02-28 | A same-origin policy violation allowing the theft of cross-origin URL entries when using the Javascript location property to cause a redirection to another sit… |
CVE-2018-18493 | Critical | 9.8 | 2019-02-28 | A buffer overflow can occur in the Skia library during buffer offset calculations with hardware accelerated canvas 2D actions due to the use of 32-bit calculat… |
CVE-2018-18492 | Critical | 9.8 | 2019-02-28 | A use-after-free vulnerability can occur after deleting a selection element due to a weak reference to the select element in the options collection. This resul… |
CVE-2018-12407 | Critical | 9.8 | 2019-02-28 | A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content, when working with the VertexBuffer11 mod… |
CVE-2018-12406 | High | 8.8 | 2019-02-28 | Mozilla developers and community members reported memory safety bugs present in Firefox 63. Some of these bugs showed evidence of memory corruption and we pres… |
CVE-2018-12405 | Critical | 9.8 | 2019-02-28 | Mozilla developers and community members reported memory safety bugs present in Firefox 63 and Firefox ESR 60.3. Some of these bugs showed evidence of memory c… |
CVE-2018-12403 | Medium | 5.3 | 2019-02-28 | If a site is loaded over a HTTPS connection but loads a favicon resource over HTTP, the mixed content warning is not displayed to users. This vulnerability aff… |
CVE-2018-12402 | Medium | 6.5 | 2019-02-28 | The internal WebBrowserPersist code does not use correct origin context for a resource being saved. This manifests when sub-resources are loaded as part of "Sa… |
CVE-2018-12401 | High | 7.5 | 2019-02-28 | Some special resource URIs will cause a non-exploitable crash if loaded with optional parameters following a '?' in the parsed string. This could lead to denia… |
CVE-2018-12400 | Medium | 5.3 | 2019-02-28 | In private browsing mode on Firefox for Android, favicons are cached in the cache/icons folder as they are in non-private mode. This allows information leakage… |
CVE-2018-12399 | Medium | 4.3 | 2019-02-28 | When a new protocol handler is registered, the API accepts a title argument which can be used to mislead users about which domain is registering the new protoc… |
CVE-2018-12398 | Medium | 6.5 | 2019-02-28 | By using the reflected URL in some special resource URIs, such as chrome:, it is possible to inject stylesheets and bypass Content Security Policy (CSP). This… |
CVE-2018-12397 | High | 7.1 | 2019-02-28 | A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed… |
CVE-2018-12396 | Medium | 6.5 | 2019-02-28 | A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events. This allows for potential privilege e… |